The Federal Bureau of Investigation has officially confirmed that North Korea’s notorious Lazarus Group orchestrated the theft of approximately $41 million in cryptocurrency from Stake.com, one of the world’s largest crypto casino and sports betting platforms. The breach, which targeted Stake-controlled wallet addresses across Ethereum, Binance Smart Chain, and Polygon, represents yet another devastating blow from a state-sponsored hacking collective that has stolen over $2 billion in digital assets over the past five years.
The Exploit Mechanics
According to on-chain analysis conducted by TRM Labs, the attack began with unauthorized access to Stake’s private keys controlling hot wallets on three separate blockchain networks. The hackers systematically drained funds from Ethereum, BSC, and Polygon addresses in a coordinated multi-chain operation. Once the stolen assets were secured, Lazarus operators initiated a sophisticated laundering pipeline. Ethereum and BSC-based tokens were quickly swapped into unfreezable native assets. The Polygon-based MATIC tokens followed a more complex route: they were swapped and bridged via Squid Router into USDT and USDC, then moved to the Avalanche network where they were converted into wrapped Bitcoin and finally bridged to the Bitcoin blockchain. This cross-chain obfuscation technique has become a hallmark of Lazarus Group operations throughout 2023, with the Avalanche Bridge serving as their preferred vehicle for moving funds to and from Bitcoin.
Affected Systems
The attack impacted Stake.com users across multiple blockchain networks simultaneously. Stake, which processes millions in daily wagers using cryptocurrencies including Bitcoin, Ethereum, and various stablecoins, temporarily suspended withdrawals following the breach. The platform’s hot wallet infrastructure was the primary attack surface. The FBI identified 40 specific cryptocurrency addresses that received the stolen funds, providing a rare public attribution that underscores the severity of the incident. This attack follows a pattern of Lazarus targeting centralized crypto platforms, with the group also responsible for approximately $60 million stolen from Alphapo and CoinsPaid in July 2023 and roughly $100 million taken from Atomic Wallet in June 2023. Cumulatively, North Korean hackers have stolen more than $200 million in cryptocurrency during 2023 alone, with Bitcoin trading around $25,900 at the time of the Stake.com attack.
The Mitigation Strategy
In response to the attack, Stake.com temporarily halted all deposit and withdrawal functions while conducting a comprehensive security audit. The platform later resumed operations after securing remaining funds and implementing enhanced wallet security protocols. Law enforcement agencies, including the FBI, have been actively tracking the movement of stolen funds across blockchains, attempting to freeze assets before they can be converted into untraceable forms. The Treasury Department’s Office of Foreign Assets Control sanctioned the Lazarus Group in 2019, which means any identified wallet addresses associated with the group can be flagged by compliant exchanges and service providers. However, the group’s increasingly sophisticated use of cross-chain bridges and decentralized exchanges makes real-time interception extremely difficult.
Lessons Learned
The Stake.com exploit reinforces several critical lessons for the cryptocurrency industry. First, hot wallets remain the weakest link in any centralized platform’s security infrastructure. Platforms that handle large volumes of user funds must implement robust multi-signature authorization and hardware security module protection for all wallet operations. Second, the speed at which Lazarus converts stolen assets across multiple chains demonstrates the urgent need for real-time cross-chain monitoring tools. The traditional approach of tracking funds on a single blockchain is no longer sufficient when attackers can move value across Ethereum, Polygon, Avalanche, and Bitcoin within hours. Third, the FBI’s public attribution of this attack to a specific nation-state actor signals an escalating awareness among global law enforcement agencies that cryptocurrency theft has become a matter of national security.
User Action Required
If you held funds on Stake.com during the breach period, immediately check your account balances and transaction history. Enable all available security features including two-factor authentication and withdrawal whitelist restrictions. For users on any centralized platform, consider transferring long-term holdings to cold storage wallets that are never connected to internet-facing services. Monitor official communications from Stake.com and the FBI for updates on fund recovery efforts. Additionally, remain vigilant against phishing attempts that may impersonate Stake.com support channels, as attackers frequently exploit the confusion following major breaches to steal additional credentials.
Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always conduct your own research before making decisions about cryptocurrency security.
2 billion over 5 years and North Korea is still running the same playbook. hot wallet private keys on a gambling platform. rinse and repeat
same playbook because it still works. as long as platforms keep millions in hot wallets this will never stop
The Squid Router laundering path through Polygon is interesting. Shows how cross-chain bridges have become the go-to for state-sponsored money laundering.
squid router is just one tool. they also use tornado cash and cross-chain bridges in sequence. the laundering stack is deeper than most realize
tornado plus squid router plus avalanche bridge in sequence. by the time OFAC flags the funds they have been through 4 chains. the laundering pipeline is industrial scale
hot wallets on a gambling site holding 41m. at some point this is just negligence not a hack
^ hard agree. any platform holding that much in hot wallets in 2023 is asking for it. basic cold storage hygiene
solmaxi trm labs analysis confirms the hot wallet path, same group behind 2b over five years
41m from stake.com via squid router on eth bsc polygon shows lazarus still active after 2b total
$2 billion stolen over 5 years by a state actor and the response is still just advisory warnings. at some point the industry needs mandatory cold storage thresholds for platforms