Norwegian authorities have traced and halted 60 million kroner (£5.9 million) in cryptocurrency stolen last year by North Korean actors, marking the largest heist of its kind ever documented.
The economic and environmental crime agency of the Scandinavian country (Økokrim) asserted that North Korean threat actors have been engaged in an extensive money laundering operation since the March 2022 attack on the Ronin Network.
"Økokrim is adept at tracking money. This case demonstrates our ability to follow cryptocurrency transactions on the blockchain, even when criminals employ sophisticated methods," stated Marianne Bender, a state attorney at Økokrim.
"We collaborate with cryptocurrency tracking specialists from the FBI. Such international cooperation strengthens our society's resilience against digital, profit-driven crime."
The Ronin Network was established by Vietnamese blockchain game developer Sky Mavis to operate as an Ethereum sidechain for its Axie Infinity game. Nevertheless, the Pyongyang-backed APT group Lazarus managed to breach the company's network when an employee opened a malicious phishing email attachment. The hackers made off with an estimated $618 million in cryptocurrency and physical cash in the world's largest cyber heist to date.
Økokrim's recent achievement follows their earlier recovery of $30 million in funds stolen from Ronin.
Chainalysis, a blockchain analysis firm involved in the operation, also revealed that North Korean hackers are using the crypto mixer Tornado Cash to facilitate the laundering of the funds stolen in the attack.
These efforts take on added significance as North Korea is likely to utilise any pilfered cryptocurrency to support its rapidly expanding missile programme.
"This is money that can assist North Korea and its nuclear weapons programme. It has, therefore, been imperative to trace the cryptocurrency and attempt to block the funds when they are converted into physical assets," explained Bender.
The recently seized funds will be returned to Sky Mavis, enabling the company to reimburse some of its affected customers.