Lazarus Group Strikes Again: $3.2M Stolen from Solana, Laundered Through Ethereum and Tornado Cash

North Korea-Linked Lazarus Group Launders $1.95M in Crypto After Solana Heist

A stealthy crypto theft traced back to North Korea’s Lazarus Group has shaken the Solana and Ethereum ecosystems, after hackers siphoned $3.2 million worth of digital assets and moved the funds through one of the most controversial privacy tools in crypto—Tornado Cash.

Funds Moved from Solana to Ethereum in Coordinated Attack

On 16 May 2025, wallets on the Solana network were drained in a targeted breach.

Blockchain analysts flagged the initial outflow from a Solana address identified as “C4WY…e525”.

The attackers didn’t linger—within hours, they bridged the stolen assets to Ethereum, a network known for its liquidity and wide toolset for asset swaps.

According to on-chain investigator ZachXBT, this manoeuvre bore striking resemblance to previous Lazarus-linked exploits.

Source: Investigations by ZachXBT

The stolen funds were swiftly swapped and transferred through a cross-chain bridge, stripping away obvious traces of origin.

Tornado Cash Used to Obscure $1.95 Million Trail

Once on Ethereum, the attackers began a familiar laundering process.

On 25 and 27 June, two separate deposits of 400 ETH—totalling roughly $1.6 million—were pushed into Tornado Cash.

These transactions match Lazarus’s typical method: break large sums into chunks, move them through privacy mixers, and scatter them across decentralised exchanges.

ZachXBT, who has long tracked high-level crypto exploits, flagged the pattern early.

He pointed to clear similarities between the transaction pattern and previous hacks associated with the Lazarus Group, citing how the funds were bridged, broken into smaller amounts, and funneled through Tornado Cash—methods the group has employed multiple times in the past.

Despite sanctions against Tornado Cash since 2022, its smart contracts remain live on Ethereum.

The U.S. appeals court decision in January 2025 to reverse the sanctions—citing free speech protections—has made enforcement murkier.

Unmoved Funds Still Held On Ethereum

Roughly $1.25 million in stolen funds remain unspent in a wallet on Ethereum labelled “0xa5…d528”.

The balance is held in ETH and DAI, sparking speculation from analysts.

Some believe the money is deliberately left dormant to avoid detection; others suggest it could be reactivated through fresh laundering layers.

Authorities and blockchain monitoring tools are likely to continue watching the address, though Tornado Cash’s ability to erase transaction history complicates future efforts.

Repeat Offender in Crypto’s Largest Heists

The Lazarus Group has long been linked to high-stakes cybercrimes.

From the $100 million Horizon bridge exploit in 2022 to the reported $1.5 billion Bybit breach earlier this year, their fingerprints appear across some of crypto’s most high-profile thefts.

Their tactics remain largely unchanged: breach wallets or smart contracts through phishing or exploits, cash out quickly, move funds across blockchains, then clean them using mixers and non-KYC exchanges.

Researchers note that the Lazarus Group tends to avoid centralised exchanges, where compliance teams can freeze suspicious wallets.

Instead, the group prefers decentralised platforms and cross-chain bridges, which allow funds to move freely without identity checks—making investigations significantly more difficult.

Is Crypto Infrastructure Ready for Nation-State-Backed Threats?

The growing reliance on cross-chain tools, automated bridges, and unregulated privacy protocols is proving to be an effective escape route for well-funded hacking groups.

When the same vulnerabilities are exploited again and again—despite sanctions, audits, and upgraded defences—it raises a fundamental question: are current crypto systems resilient enough to handle threats backed by entire regimes?

With mixers still online and cross-chain swaps left largely unguarded, Lazarus isn't just exposing gaps in infrastructure—they’re exploiting a system that was never built for national-scale cyber warfare.