Two Chinese nationals who are alleged to have laundered around $100 million in cryptocurrency on behalf of the infamous North Korean hackers Lazarus Group have been indicted by the U.S. Department of Justice.

Tian Yinyin and Li Jiadong are accused of laundering cryptocurrency stolen from the hack of two unnamed cryptocurrency exchanges. The U.S. Department of Treasury claimed Monday that the pair received approximately $91 million from North Korea following the hack of an exchange in April 2018, then $9.5 million more in the hack of another exchange that they transferred to other addresses to conceal the origin of the funds.

Having laundered the cryptocurrency, the pair is then said to have cashed out the equivalent for $34 million in Chinese renminbi via bank accounts along with purchasing $1.4 million of Apple iTunes gift cards with stolen bitcoin.

“The hacking of virtual currency exchanges and related money laundering for the benefit of North Korean actors poses a grave threat to the security and integrity of the global financial system,” U.S. Attorney Timothy J. Shea said in a statement.

The indictment did not name the cryptocurrency exchanges targeted, but at least one is easy to match: the hack of Cryptsy in July 2014 that saw the theft of $9.5 million in cryptocurrency.

Notably, however, the Justice Department claims that North Korean co-conspirators are alleged to have hacked into an exchange and stole nearly $250 million worth of cryptocurrency in 2018. That hack can’t be matched against known hacks either, but it could suggest that Yinyin and Jiadong were tasked with laundering only some of the stolen funds.

The indictment also included a forfeiture order, although whether the accused pair continue to hold assets in the U.S. is unclear. The indictment claims that the defendants conducted business in the United States, naming “113 virtual currency accounts and addresses that were used by the defendants and unnamed co-conspirators to launder funds.”

The Lazarus Group was last in the news in December when it was reportedly targeting Linux systems alongside Windows. The group is known for allegedly being behind the spread of the WannaCry ransomware in 2017

Photo: fljckr/Flickr