Millions

Yuan

ZachXBT

Tornado

WazirX

<p>In a recent shocking revelation, a Chinese OTC trader has been accused of allegedly helping the Lazarus Group, a North Korean crypto hacker group, cash out money stolen from multiple hacks.</p> 
<p>ZachXBT, a blockchain sleuth, recently <a href="https://x.com/zachxbt/status/1849071080180240751" target="_blank" rel="noreferrer noopener nofollow">shared</a> a post on X where he detailed his investigation and on-chain analysis linking a person named Yicong Wang (王逸聪) to these activities. In his investigation, ZachXBT reveals Wang’s connection to numerous transactions tied to a bizarre hack performed by the Lazarus Group, in which millions of dollars were drained from various crypto platforms. These hacks involve EasyFi, Bondly, the Maverick co-founder, and others.</p> 
<h2 class="wp-block-heading" id="meet-the-master-of-deception-yicong-wang">Meet the Master of Deception: Yicong Wang</h2> 
<p>Learning about Blockchain can be challenging, especially for those unfamiliar with the space. So, here’s a creative piece that makes it fun and easy to read without getting boring or confusing.</p> 
<p>Before diving into the story of digital loot, let me introduce you to the heroes and villains of this tale. ZachXBT is our hero, solving the mystery and tracking down a person who helped hackers cash out millions of dollars. On the other hand, Yicong Wang is the villain roaming free in the shadows, secretly helping the Lazarus Group while staying hidden.</p> 
<p>Alright, let’s begin this story with a bang!</p> 
<h3 class="wp-block-heading" id="1-let-s-uncover-something-yet-nothing-about-yicong-wang">1. Let’s uncover something, yet nothing, about Yicong Wang (王逸聪)</h3> 
<p>Yicong Wang is the main villain of our story, who is a Chinese OTC trader. Think of him as the middleman or a dealer who helps convert stolen cryptocurrency funds into hard cash. Wang has been linked to the infamous Lazarus, a North Korean hacking group that has looted tens of millions of dollars from people all over the internet since 2022.</p> 
<h3 class="wp-block-heading" id="2-trouble-for-innocent-traders-hero-s-entry">2. Trouble for Innocent Traders &amp; Hero’s Entry&nbsp;</h3> 
<p>A few months back, an innocent crypto trader “Sam” experienced something strange. His exchange account was frozen right after he made a simple P2P (peer-to-peer) transaction with Wang. Saw was unaware of the truth that he had unknowingly dealt with a criminal.&nbsp;</p> 
<p>To deceive people like Sam, Wang used fake names like Seawang, Greatdtrader, and BestRhea977 to hide his true identity.</p> 
<p>Here’s where our hero, ZachXBT comes into the play. Sam shared one of Wang’s crypto wallet addresses with ZachXBT. The wallet opened the door to a pile of evidence. One address, <strong><em>THsSCBGazjjho7u2BQQsmrpbDv1Q237FL4</em></strong>, was like a fingerprint connecting Wang to some dirty dealings.</p> 
<h3 class="wp-block-heading" id="3-a-deal-too-good-to-be-true">3. A Deal Too Good to Be True</h3> 
<p>Fast forward to August 2024, when Wang offered Sam a tempting deal to trade 1.5 million USDT, a widely known stablecoin pegged with USD, for Chinese Yuan at a bargain price. Surprisingly, This offer was far below the market rate. Suspicious much? Here’s the wallet address tied to the shady deal: <strong><em>THjaAygUNkzoXufwEoKCzbUZHpsehL9rAZ.</em></strong></p> 
<div class="wp-block-image"> 
 <figure class="aligncenter">
  <img loading="lazy" decoding="async" width="838" height="495" src="https://www.cryptotimes.io/wp-content/uploads/2024/10/image-3.jpeg" alt="image 3" class="wp-image-210236" srcset="https://www.cryptotimes.io/wp-content/uploads/2024/10/image-3.jpeg 838w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-3-800x473.jpeg 800w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-3-768x454.jpeg 768w" sizes="(max-width: 838px) 100vw, 838px">
 </figure>
</div> 
<h3 class="wp-block-heading" id="4-the-stolen-crypto-trail">4. The Stolen Crypto Trail</h3> 
<p>But, here Wang made a first mistake, which is going to expose him in front of the entire cryptoverse.&nbsp;</p> 
<p>While digging Wang’s past, investigators found something big and shady. His address was linked to a bunch of cyberattacks and has a “high illicit fund exposure from the Alex Labs, Irys co-founder, and a consolidation of other hacks (EasyFi, Bondly, Maverick co-founder, etc)”.&nbsp;</p> 
<p>Millions of dollars stolen from different platforms like Alex Labs and Irys were passing through his wallets. It is like watching money move from place to place, leaving a trail that only a sharp eye can track.</p> 
<figure class="wp-block-image size-large">
 <img loading="lazy" decoding="async" width="1024" height="430" src="https://www.cryptotimes.io/wp-content/uploads/2024/10/Chinese-OTC-Trader-Helps-Lazarus-Group-Cash-Out-Hacked-Crypto-1-1024x430.jpg" alt="Addresses belonging to Wang, which have connections with multiple hacks" class="wp-image-210211" srcset="https://www.cryptotimes.io/wp-content/uploads/2024/10/Chinese-OTC-Trader-Helps-Lazarus-Group-Cash-Out-Hacked-Crypto-1-1024x430.jpg 1024w, https://www.cryptotimes.io/wp-content/uploads/2024/10/Chinese-OTC-Trader-Helps-Lazarus-Group-Cash-Out-Hacked-Crypto-1-800x336.jpg 800w, https://www.cryptotimes.io/wp-content/uploads/2024/10/Chinese-OTC-Trader-Helps-Lazarus-Group-Cash-Out-Hacked-Crypto-1-768x322.jpg 768w, https://www.cryptotimes.io/wp-content/uploads/2024/10/Chinese-OTC-Trader-Helps-Lazarus-Group-Cash-Out-Hacked-Crypto-1-1536x645.jpg 1536w, https://www.cryptotimes.io/wp-content/uploads/2024/10/Chinese-OTC-Trader-Helps-Lazarus-Group-Cash-Out-Hacked-Crypto-1-scaled.jpg 2048w, https://www.cryptotimes.io/wp-content/uploads/2024/10/Chinese-OTC-Trader-Helps-Lazarus-Group-Cash-Out-Hacked-Crypto-1-860x361.jpg 860w" sizes="(max-width: 1024px) 100vw, 1024px">
 <figcaption class="wp-element-caption">
  Addresses belonging to Wang, which have connections with multiple hacks
 </figcaption>
</figure> 
<h3 class="wp-block-heading" id="5-a-17-million-loot">5. A $17 Million Loot</h3> 
<p>Wang’s wallet had over $17 million from more than 25 Lazarus Group hacks. But here is a plot twist: Tether blacklisted one of his wallets, freezing $374,000 USDT in November 2023.&nbsp;</p> 
<p>In December 2023, $45K was moved to the Tron network and sent to several addresses linked to Yicong. ZachXBT investigation says, “Within days after the deposits 13 X 100 ETH was withdrawn and consolidated at 0x81a”.</p> 
<div class="wp-block-image"> 
 <figure class="aligncenter">
  <img loading="lazy" decoding="async" width="1600" height="557" src="https://www.cryptotimes.io/wp-content/uploads/2024/10/image.jpeg" alt="Tron wallet addresses linked to Wang" class="wp-image-210233" srcset="https://www.cryptotimes.io/wp-content/uploads/2024/10/image.jpeg 1600w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-800x279.jpeg 800w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-1024x356.jpeg 1024w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-768x267.jpeg 768w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-1536x535.jpeg 1536w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-860x299.jpeg 860w" sizes="(max-width: 1600px) 100vw, 1600px">
 </figure>
</div> 
<p>Wang quickly moved the rest of the stolen funds through Tornado Cash, a tool that shuffles transactions to make them harder to trace. Though our hero is very smart, it wasn’t a problem for him.</p> 
<div class="wp-block-image"> 
 <figure class="aligncenter is-resized">
  <img loading="lazy" decoding="async" width="1600" height="861" src="https://www.cryptotimes.io/wp-content/uploads/2024/10/image-2.jpeg" alt="Transaction proof on TRX" class="wp-image-210235" style="width: 100%;height:auto" srcset="https://www.cryptotimes.io/wp-content/uploads/2024/10/image-2.jpeg 1600w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-2-800x431.jpeg 800w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-2-1024x551.jpeg 1024w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-2-768x413.jpeg 768w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-2-1536x827.jpeg 1536w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-2-860x463.jpeg 860w" sizes="(max-width: 1600px) 100vw, 1600px">
 </figure>
</div> 
<p>To read more about How Lazarus Group laundered $200M from 25+ crypto hacks to fiat from 2020 – 2023, read this <a href="https://x.com/zachxbt/status/1784935501935390930" target="_blank" rel="noreferrer noopener nofollow">thread</a>.</p> 
<h3 class="wp-block-heading" id="6-the-alex-labs-heist">6. The Alex Labs Heist</h3> 
<p>In May 2024, Alex Labs was <a href="https://x.com/ALEXLabBTC/status/1805415489717551402" target="_blank" rel="noreferrer noopener nofollow">hacked</a> for $4.5 million. On June 16, 2024, one of the hacker’s wallets deposited 470 ETH into a privacy protocol. It is like hiding gold in a secret vault. The next day, the same amount (470 ETH) was withdrawn and split between two new addresses, one of which is <strong><em>0x9fc1350f80734044b7189fe7b8f288396f76feb5</em></strong><em>.</em></p> 
<div class="wp-block-image"> 
 <figure class="aligncenter">
  <img loading="lazy" decoding="async" width="1600" height="489" src="https://www.cryptotimes.io/wp-content/uploads/2024/10/image-5.jpeg" alt="image 5" class="wp-image-210238" srcset="https://www.cryptotimes.io/wp-content/uploads/2024/10/image-5.jpeg 1600w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-5-800x245.jpeg 800w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-5-1024x313.jpeg 1024w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-5-768x235.jpeg 768w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-5-1536x469.jpeg 1536w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-5-860x263.jpeg 860w" sizes="(max-width: 1600px) 100vw, 1600px">
 </figure>
</div> 
<p>The hacker was not stopped there. More stolen ETH was moved around in late June and August, which eventually landed in wallets linked to Wang! Isn’t he always a few steps ahead and great at moving fast?</p> 
<h3 class="wp-block-heading" id="7-irys-co-founder-gets-scammed">7. Irys Co-Founder Gets Scammed&nbsp;</h3> 
<p>In July 2024, the co-founder of Irys became the next victim of the Lazarus Group. A sneaky email phishing attack led to $1.3 million in stolen funds. By analyzing the transactions, detectives found that these stolen cryptocurrencies were mixed with the Alex Labs hack, linking the crimes together.</p> 
<figure class="wp-block-image aligncenter">
 <img loading="lazy" decoding="async" width="1600" height="481" src="https://www.cryptotimes.io/wp-content/uploads/2024/10/image-4.jpeg" alt="Crypto stolen from Irys co-founder has connection with Wang
" class="wp-image-210237" srcset="https://www.cryptotimes.io/wp-content/uploads/2024/10/image-4.jpeg 1600w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-4-800x241.jpeg 800w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-4-1024x308.jpeg 1024w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-4-768x231.jpeg 768w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-4-1536x462.jpeg 1536w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-4-860x259.jpeg 860w" sizes="(max-width: 1600px) 100vw, 1600px">
</figure> 
<h3 class="wp-block-heading" id="8-blacklisted-wallets">8. Blacklisted Wallets</h3> 
<p>In August 2024, another wallet connected to Wang was blacklisted by Tether. Almost $950K was frozen, but not before Wang moved 746K USDT through another shady address: <strong><em>THjaAygUNkzoXufwEoKCzbUZHpsehL9rAZ</em></strong>.&nbsp;</p> 
<div class="wp-block-image"> 
 <figure class="aligncenter">
  <img loading="lazy" decoding="async" width="1600" height="635" src="https://www.cryptotimes.io/wp-content/uploads/2024/10/image-1.jpeg" alt="Frozen Wallet Address" class="wp-image-210234" srcset="https://www.cryptotimes.io/wp-content/uploads/2024/10/image-1.jpeg 1600w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-1-800x318.jpeg 800w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-1-1024x406.jpeg 1024w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-1-768x305.jpeg 768w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-1-1536x610.jpeg 1536w, https://www.cryptotimes.io/wp-content/uploads/2024/10/image-1-860x341.jpeg 860w" sizes="(max-width: 1600px) 100vw, 1600px">
 </figure>
</div> 
<h2 class="wp-block-heading" id="climax-the-end-for-yicong-wang">Climax: THE END For Yicong Wang</h2> 
<p>Wang’s tricks have not gone unnoticed. He’s been banned from major platforms like Paxful and Noones for using fake identities. Yet, he is still operating under the radar, avoiding authorities and laundering money for a dangerous hacker group like Lazarus Group.</p> 
<p>For now, Yicong Wang remains out of reach. However, with investigators closing in, it might just be a matter of time before he is caught digitally as he has already been exposed in front of the crypto community.&nbsp;</p> 
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow"> 
 <p>Also Read: <a href="https://www.cryptotimes.io/2024/09/06/exclusive-are-these-north-korean-hackers-behind-wazirx-hack/" target="_blank" rel="noreferrer noopener">Exclusive: Are these North Korean Hackers behind WazirX Hack?</a></p> 
</blockquote>

Chinese OTC Trader Helps Lazarus Group Cash Out Hacked Crypto: ZachXBT

Table of Contents

The Crypto Times

Other articles published on Oct 24, 2024

Core Foundation Launches Developer-Focused 'Core Commit Program' with Funding and Mentorship

New Solana Memecoin Musk to Mars Will Rally 16,000% Ahead of First Exchange Listing, As Dogecoin ...

The Notorious Lazarus Hacker Group Resurfaces In 2024 With A Fake NFT Game

Breaking News: In Its Filing with the SEC, Microsoft Reportedly Discussed a Proposal for a “Bitco...

21 Best Crypto YouTube Channels to Watch in 2024

Brad Garlinghouse Reflects on XRP-SEC Legal Struggles; Says He Regrets Not Engaging U.S. Regulato...

Join our free newsletter for daily crypto updates!