Law enforcement agencies have recovered $30 million in cryptocurrency stolen during the hack of the NFT game Axie Infinity earlier this year. Blockchain analysts, the FBI, and the U.S. government announced that they managed to seize the funds, which were stolen by the North Korean Lazarus group from the developers of Axie Infinity in the spring of 2022.
Background of the Axie Infinity Hack
The attack on Axie Infinity and the Ronin sidechain took place in March 2022. Hackers managed to steal over $600 million from the NFT game through just two transactions: 173,600 ETH (worth about $591,242,019) and $25.5 million in the stablecoin USDC. This incident became one of the largest hacks in history, involving the compromise of Sky Mavis Ronin validator nodes and Axie DAO validator nodes, which allowed the attackers to exploit the Ronin bridge.
Partial Recovery of Stolen Funds
The partial return of the stolen funds was announced at the AxieCon event, where organizers called it a community achievement and the result of extensive cooperation between multiple law enforcement agencies and private individuals. The recovered funds will gradually be returned to the Axie Infinity treasury and back to players, but developers warn that this process could take several years.
How the Hackers Laundered the Funds
Experts from Chainalysis, who participated in the investigation, noted that this is the first time stolen funds have been confiscated from North Korean hackers, but it likely won’t be the last. According to analysts, the hackers followed a typical five-step laundering process:
- Sent the stolen Ether to intermediary wallets
- Used the Tornado Cash mixer to “mix” the Ether in batches
- Exchanged Ether for Bitcoin
- “Mixed” the Bitcoin in batches
Impact of Sanctions and Further Investigations
Recent sanctions imposed by the U.S. Department of the Treasury against Tornado Cash forced the Lazarus group to use alternative services to launder the remaining third of the stolen funds. The hackers also used blockchain bridges to conceal their activities. Nevertheless, Chainalysis experts were able to track this activity and identify attempts to exchange the cryptocurrency, which helped law enforcement freeze and recover part of the funds.
Ongoing Challenges and Significance
Since the total damage from the Lazarus attack on Axie Infinity was estimated at over $600 million, the recovered amount represents only about 5% of the total (or about 10% of the amount in cryptocurrency). However, experts believe this is a significant blow to the Lazarus group, as it sends a clear signal that stolen digital assets are becoming increasingly difficult to move, launder, and cash out into fiat currency.
Chainalysis notes that most of the funds stolen from Axie Infinity still remain unused in the hackers’ cryptocurrency wallets, and the attackers are running out of reliable options to cash out these assets.