Atomic Wallet Hackers Stole $35M Using OFAC-Approved Garantex: Report

Crypto assets stolen during the Atomic Wallet hack have found their way to Garantex, a Russia-based cryptocurrency exchange, in which the attackers traded the tokens for bitcoin (BTC).

according to a do From blockchain analytics provider Elliptic, hackers who are believed to be part of North Korea’s infamous Lazarus Group have turned to Garantex as multiple crypto exchanges are working together to freeze funds related to the hack.

Atomic Wallet Hackers Turn to Garantex

Guarantex was approved last year by the Office of Foreign Assets Control (OFAC), months after Russian President Vladimir Putin invaded Ukraine. The US Treasury said the platform loosened anti-money laundering measures and accommodated illegal players. However, the exchange continued its operations and played a significant role in facilitating illegal crypto transactions.

The non-custodial decentralized Atomic Wallet was compromised earlier this month, with many users reporting that their accounts had been liquidated. While losses for the biggest victim ran into six figures, over $35 million in crypto assets were snatched through the attack. The stolen assets include BTC, Ether (ETH), Tether (USDT), Dogecoin (DOGE), Litecoin (LTC), BNB Coin (BNB) and Polygon (MATIC).

Days after the exploit, hackers funneled the stolen crypto into Sinbad.io, a crypto mixer that was used by the Lazarus Group to launder crypto assets. Funds from Garantex are still being moved to Sinbad.io.

Before moving the stolen assets to Garantex, the hackers used the on-chain trading platform 1inch to exchange them for USDT. From Garantex, they were swapped for BTC and moved to Sinbad.io.

ongoing investigation

The Atomic Wallet team claims that the attack affected less than 1% of its monthly active users. The team said they enlisted the services of blockchain security firm Chainalysis as the lead investigator and joined forces with several exchanges and analytics companies to track down and freeze the stolen funds.

It is unclear whether Atomic Wallet has engaged law enforcement officials in the matter. Furthermore, the platform has yet to determine the vector of the attack or indicate whether reparations plans are underway.