Despite looting $41 million in cryptos, Stake co-founder Ed Craven said the hackers did not compromise private user info or access customer funds during the attack.
Edward Craven, co-founder of crypto casino Stake, published preliminary findings from a Sept. 4 incident that the Federal Bureau of Investigation (FBI) says was masterminded by North Korean hackers.
Craven wrote in a Medium blog post that the attacker targeted Stake’s ETH/BSC hot wallets. The sports betting platform uses these internet-linked wallets for daily transactions and large customer payouts, according to Craven.
Stake’s security team stemmed the unauthorized transactions in four hours, but not before hackers siphoned $41 million in cryptocurrencies.
The exploiters withdrew their booty via Ethereum (ETH), Binance Smart Chain, and Polygon (MATIC). Funds from the attack were later bridged to Bitcoin’s blockchain through a basket of addresses.
Craven noted that user info and private customer details were never exposed during the incident. Also, the hackers never accessed user funds or account balances on the platform, Stake’s co-founder added.
The FBI said TraderTraitor organization APT38 was behind the attack on Stake in a Sep. 6 press release. APT38, more commonly known as Lazarus, is a criminal group specializing in sophisticated cyber attacks.
US authorities have said that Lazarus is funded by the regime in North Korea and is believed to have stolen over $1 billion in virtual currencies since 2022.
Tornado Cash, an Ethereum-powered privacy protocol, was sanctioned in 2022 over links to Lazarus’ money laundering schemes.
The Justice Department indicted a duo of Tornado Cash developers, claiming they conspired to abet bad actors by building decentralized software.
One of the accused, Roman Storm, pleaded not guilty to conspiracy and money laundering charges before a federal court.
Fellow Tornado Cash developer Alexey Pertserv was arrested in the Netherlands and charged with similar offenses.