Atomic Wallet Sued For $100M Over Security
Atomic Wallet's Big Trouble: Exploring the $100 million hack and what it means for everyday crypto users and their digital safety.
Atomic Wallet, a prominent player in the digital wallet space, finds itself embroiled in a legal storm following a security breach that led to a staggering $100 million loss for its users.
When news of the Atomic Wallet breach first broke in June 2023, the initial damage was estimated at $35 million. However, as investigations progressed, security firm Elliptic revised this figure, revealing that the actual losses were closer to $100 million. This discrepancy underscores the often-hidden complexities of crypto heists and the challenges in assessing their actual impact.
The North Korean Lazarus Group, known for its cyber-espionage and cybercrime operations, was initially believed to be the mastermind behind the attack. Their involvement raised concerns about the increasing sophistication of state-sponsored cybercriminals targeting the crypto industry.
Who is the Lazarus Group?
The Lazarus Group, often called "Lazarus," is a North Korean state-sponsored cyber threat group intricately linked to the North Korean Reconnaissance General Bureau (RGB). Established in 2009, the RGB is a North Korean intelligence agency responsible for a myriad of tasks, including spying, covert operations, and, notably, cyber espionage. Over the years, the RGB has focused on gathering data and attempting to exfiltrate funds from countries such as South Korea, the United States, and Japan. Within the RGB, Bureau 121 stands out as the primary entity responsible for cybersecurity.
One of the Lazarus Group's early notable attacks was "Operation Troy," which utilized a distributed denial of service attack (DDoS) to disrupt South Korean government websites and servers. However, their activities continued. In 2014, the group was believed to be behind a significant attack on Sony Pictures, where they leaked valuable movie content, internal emails, and personal information of over 4,000 Sony Pictures employees. This attack alone cost Sony over $35 million in IT repairs, not to mention the substantial damage to its reputation. The hackers initially identified themselves as the "Guardians of Peace," but it was later revealed that this group was, in fact, a part of the Lazarus Group.
How Lazarus Group moves hacked funds
Lazarus's activities have been widespread, targeting high-profile organizations in over 31 countries. Their modus operandi often involves using a "watering hole attack," where loader software installs malware on specific websites. This malware is then used to target particular IP addresses associated with residents of specific countries or organizations. Over the years, the group has adopted various identities for different campaigns, such as IsOne, WhoIs Team, and the NewRomanic Cyber Army Team. Their ability to "disappear" after attacks and resurface under new identities has made tracking and attributing their activities challenging for cybersecurity experts. However, their consistent reuse of specific malware code has been a telling sign of their operations. While some of their cyberattacks aim to extort money, others are designed to gather intelligence and surveil targeted organizations.
Inside the Class-Action Lawsuit
The lawsuit, initiated by a group of Atomic Wallet users, alleges that the company's "negligent and unlawful conduct" directly contributed to the massive security breach. These users, who span across various countries, have come together in a unified legal front, seeking justice and compensation.
One of the lawsuit's most damning allegations is Atomic Wallet's purported prior knowledge of a security vulnerability. Reports suggest that in 2022, security firm Least Authority had highlighted this vulnerability to Atomic Wallet. Instead of acting on this critical information, Atomic Wallet allegedly chose inaction, a decision that would later have severe repercussions.
The lawsuit's primary objective is to secure compensation for the affected users. The plaintiffs are not just seeking the return of their lost funds but are also demanding punitive damages, arguing that Atomic Wallet's negligence was not just an oversight but a grave dereliction of duty.