Tether blacklists $14 million from Lazarus-connected DMM Bitcoin hack

Over the weekend, Tether blacklisted a wallet holding $29.6 million worth of USDT stablecoins connected to Huione Guarantee, a Cambodian marketplace allegedly linked to a multi-billion dollar online scam economy, according to pseudonymous on-chain sleuth ZachXBT.

At least $14 million of that amount is tied to the infamous hack of the Japanese crypto exchange DMM Bitcoin, which lost an estimated $300 million in an “unauthorized outflow of funds” in early June. ZachXBT claims to have found that some $35 million connected to that exploit has been laundered via Huione Guarantee.

Lazarus Group, perhaps the most prolific unit of crypto protocol hackers, is thought to be behind the hack. "It is suspected that Lazarus Group is behind the hack due to similarities in laundering techniques and off-chain indicators," ZachXBT wrote on X. 

"The laundering path for funds transferred to Huione from the DMM Bitcoin hack can be summarized as: 1) Deposit BTC to mixer from the hack 2) Withdraw BTC from mixer 3) Bridge funds from Bitcoin to Ethereum or Avalanche via THORChain, Threshold, Avalanche bridge 4) Swap for USDT and bridge to Tron via SWFT 5) Transfer USDT to Huione," ZachXBT wrote. 

The affiliated Huione Pay received at least $150,000 worth of crypto from a wallet associated with Lazarus, Reuters reported Monday . Huione Group has alleged ties to the Cambodian ruling family.

Last week, blockchain analytics firm Elliptic released a report finding that Huione merchants have been advertising a number of illicit services, including money laundering . The firm traced $11 billion worth of transactions since the market launched three years ago, finding that much of it had been laundered from internet scams like “pig butchering” and crypto schemes.

"Huione has become a major hub for illicit funds in South East Asia, primarily being used by criminal organizations such as pig butchering gangs," ZachXBT wrote. "Last year I found millions from the $31M Fintoch investment fraud scheme went to Huione."

The sleuth also released over 500 Bitcoin, Tron, and Ethereum addresses, which he is following to track the money flows from the DMM Bitcoin hack.