North Korea-backed Lazarus group has stepped up their use of sanctioned crypto mixer Tornado Cash, moving over $100 million worth of Ethereum through the platform in the past week.

According to blockchain security firm PeckShield, addresses linked to the exploiters of Justin Sun-linked HTX exchange and Heco Bridge have transferred 40,391 ETH, equivalent to $145.7 million, via the decentralized crypto mixing tool.

A chart detailing the flow of funds shows that 18 different addresses were used to send funds to two Tornado cash addresses.

These transfers mark the first time the funds will be moving since they were stolen during the HTX and Heco bridge exploitation last November. The attack is widely believed to have been performed by North Korea-backed hackers.

Last week, CryptoSlate reported that the North Korea-backed hacker group was again utilizing the sanctioned crypto mixer Tornado Cash. This resurgence comes after the US government’s crackdown on centralized mixers like Sinbad.io.

Blockchain analytics firm Elliptic explained that Lazarus’s return to Tornado Cash reflects the challenges authorities face in curtailing the operations of such decentralized mixers.

Over $750 million stolen in 2023

North Korea-linked hackers stole more than $750 million last year from different crypto projects, South Korean news agency Yonhap reported on March 21, citing a UN report.

Last year, US authorities had linked the Lazarus group to several crypto hacks and exploitations, including the $41 million hack of online casino platform Stake and the $100 million stolen from Atomic Wallet.

Meanwhile, the total amount stolen by these state-sponsored malicious attackers drastically increases to about $3 billion when the time frame is extended to between 2017 and 2023.

According to the report, the heavily sanctioned country used these attacks to generate about 50% of its foreign currency earnings. The country also allegedly uses these illicit proceeds to fund its weapons program.