Clustering across services and chains

Graduate · enrolled learners

This lesson opens with Lazarus cross-chain laundering, 2022 onward.

What happened

The North Korea-linked Lazarus Group has stolen billions, including about 625 million dollars from the Ronin bridge in March 2022, and it launders across chains on purpose. Stolen Ethereum is passed through the Tornado Cash mixer, swapped, and moved over cross-chain bridges into Bitcoin and back, because each hop through a service breaks the direct address trail: the bridge or mixer takes funds in at one address and pays out from a different pool, so common-input-ownership and change detection, which work within one chain's address graph, do not carry across the gap. Investigators at firms like Chainalysis and Elliptic followed it anyway, by correlating the deposits into a service with the withdrawals out of it, matching amounts, timing and sequence to link an entity's funds across the break, and by cross-referencing with sanctions data and known Lazarus infrastructure. The trail across chains was reconstructed not by a shared key but by evidence of correspondence.

The decision point

Address-level clustering has a hard edge: it lives inside one chain's transaction graph, and a service, a mixer, an exchange, a bridge, is a wall the graph does not cross. Funds go in as inputs to the service and come out as unrelated outputs from the service's own pool, so the co-spending and change signals that clustered an entity stop at the door. Following an entity across that wall is a different move: not proving one owner signed, but showing that the funds out correspond to the funds in, by amount, by timing, by sequence, by any pattern the launderer could not fully scramble. This is clustering across services and chains, and it is both weaker and unavoidable, because every serious launderer routes through exactly these walls. The analyst who stops at the mixer has followed the money to the edge of one graph; the analyst who can argue a correspondence across it keeps the trail alive.

Recorded loss

$625,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.