
Key Takeaways:
- $4.3 Million Exploit Linked to Lazarus Group: Alex Lab and blockchain investigator ZachXBT identified North Korea’s Lazarus Group as responsible for the May 16 exploit.
- Extensive Transactions and Fund Freezing: Hackers used multiple wallets to steal $13.7 million, partially frozen after moving through DeFi protocols and centralized exchanges.
- Bounty Offer Ignored: Despite offering a 10% bounty for the return of 90% of stolen funds, Alex Lab received no response from the attackers.
Alex Lab, a Bitcoin layer-2 developer, has linked a $4.3 million exploit in May to North Korea’s Lazarus Group.
The discovery was made through substantial transaction evidence and the collaboration with blockchain investigator ZachXBT.
Update on the ALEX Incident Investigation
— ᛤ ALEX 🟧 THE Finance Layer on Bitcoin ᛤᛤᛤ (@ALEXLabBTC) June 25, 2024
Dear ALEX Community,
We wish to share an important update on the ALEX incident investigation from last month, which resulted in unauthorized access and the loss of funds. We understand the severity of this issue and are committed to full…
The exploit occurred on May 16, when hackers used three wallet addresses to steal funds from Alex Lab’s DeFi protocol on the BNB Smart Chain and additional Stacks (STX) tokens, totaling $13.7 million, some of which were frozen after being sent to centralized exchanges.
On June 20, Alex Lab revealed that over 11,800 STX transactions had been broadcasted by the attackers, who used various DeFi protocols and bridges to convert the stolen tokens.
Despite the private keys being accessed, the smart contracts of Alex Protocol were not compromised.
ALEX LAB'S $4M EXPLOIT LINKED TO LAZARUS GROUP: WHAT WE KNOW
— BSCN (@BSCNews) June 25, 2024
– Alex Lab has revealed that its recent $4 million exploit is likely linked to the Lazarus Group, a North Korea-backed hacking entity.
– The announcement was made after extensive investigations led by crypto sleuth… https://t.co/c9vzed65y9 pic.twitter.com/ACloKYrMlx
Alex Lab offered a 10% bounty for the return of 90% of the stolen funds with a promise not to pursue legal action, but the attackers did not respond.