Suspected DMM Bitcoin Hackers Move 500 BTC to New Addresses

A crypto address linked to the $305 million DMM Bitcoin hack in May is believed to have moved 500 Bitcoin, worth an estimated $30.4 million.

According to PeckShield Alert, the suspicious address first moved the Bitcoin (BTC) to two addresses, each of which received approximately 250 BTC.

The funds are suspected of being part of the 4,502.9 BTC stolen from Japanese crypto exchange DMM Bitcoin in May. The stock was then valued at about $305 million, but would be worth just over $274 million at current pricesShortly after the attack, DMM Bitcoin raised $320 million, with which victims of the hack were compensated.

Blockchain researcher ZachXBT previously blamed notorious hackers, the Lazarus Group, linked to the Democratic People’s Republic of Korea, for the DMM Bitcoin attack. The on-chain analyst said that the techniques used to launder the stolen crypto and various other off-chain indicators pointed to the Lazarus Group as the culprits.

Shortly after the hack, the attackers are said to have divided the stolen Bitcoin into smaller batches of 500 BTC and moved them to new wallets. The funds Peckshield identified originated from one of these wallets and are the latest to be moved since the May 31 hack.

In July, ZachXBT claimed that attackers had moved approximately $35 million worth of Bitcoin to the Cambodia-based exchange, Huione Guarantee. The exchange was recently accused of facilitating the laundering of funds from crypto hacks, pig scams, and other crypto exploits.

4/4 Huione has become a major hub for illicit funds in Southeast Asia, mainly used by criminal organizations such as pig slaughterers.

A recent report from blockchain analytics firm Elliptic found that traders on the platform are estimated to have made over $11 billion in… https://t.co/n4E0rorhv9 photo.twitter.com/DJkweWYJPm

— ZachXBT (@zachxbt) July 14, 2024

As crypto news reported in July, Tether froze a Tron wallet believed to belong to Huione, containing over $28 million in USDT which are believed to be the proceeds of crime.

According to the crypto sleuth, the DMM Bitcoin attackers typically move the stolen cryptocurrency to privacy mixers and then bridge it to Ethereum (ETH) and Avalanche (AVAX) using THORChain. The thieves then convert the funds to Tether (USDT), move them to Tron (TRX), and finally deposit them into Huione.