Tracing Atomic Wallet Hack Leads to Crypto Mixer Used by North Korea Hacking Collective

An analysis by Elliptic has discovered that the hackers laundered the stolen money from the Atomic Wallet hack at the Sinbad.io mixer.

Unknown perpetrators successfully executed a significant exploit on Atomic Wallet last week. It resulted in the theft of approximately $35 million from the multichain crypto wallet.

Atomic Wallet Stolen Funds Laundered

Elliptic’s Investigations Team has discovered that a “large number” of wallets were affected in the exploit. This comes days after the non-custodial crypto wallet reported the hack. The Atomic Wallet had originally said that “less than 1%” of users were affected.

At the time, BeInCrypto reported that the hack impacted at least 100 wallet addresses, affecting various cryptocurrencies.

In February, Elliptic’s research showed that Sinbad.io is a rebranded version of Blender.io, which the U.S. Department of the Treasury had previously banned for having links to laundering stolen money. This followed the Treasury placing a sanction on the Tornado Cash crypto mixer in August 2022.

The investigation of the transaction trail uncovered a prominent mixer commonly used for money laundering. Blender gained attention when it came to light that North Korea’s Lazarus Group utilized it to launder money. It allegedly laundered more than $100 million in stolen cryptocurrency.

Blender Reemerges as Sinbad 

Sinbad debuted in October 2022, the same year Blender shut down in April.

According to Elliptic’s earlier investigation, Blender and Sinbad share a connection to Russia and exhibit comparable transaction patterns, funding sources, operational traits, website structure, and language support. According to the research, the reason for rebranding Blender may be to avoid penalties and earn back user confidence after Blender’s closure and financial disappearance.

In the past, Blender was used by hackers to launder millions of dollars taken during the Axie Infinity attack. A cross-chain bridge vulnerability cost Axie Infinity over $600 million in March 2022.

The Treasury announced at the time that it would keep looking into the use of mixing services for illegal activity. And it likely won’t be long before Sinbad.io enters law enforcement’s sights.

Elliptic’s earlier blog post highlighted the utilization of mixers to transfer the stolen funds, defying restrictions imposed across multiple blockchains and assets. Hackers reportedly used centralized and decentralized exchanges as well as cross-chain bridges to obscure the traceability of the transactions.