The hackers behind the March 23 theft of roughly $625 million worth of cryptocurrency from the Ronin blockchain are based in North Korea, according to a new announcement from the FBI. The federal law enforcement agency claims the Lazarus Group, North Korea’s most notorious hacker gang, is laundering the money for Kim Jong Un’s regime and the U.S. Treasury is working to stop the flow of funds however it can.


“The FBI continues to combat malicious cyber activity including the threat posed by the Democratic People’s Republic of Korea to the U.S. and our private sector partners. Through our investigation we were able to confirm Lazarus Group and APT38, cyber actors associated with the DPRK, are responsible for the theft of $620 million in Ethereum reported on March 29th,” the FBI said in a statement late Thursday.


“The FBI, in coordination with Treasury and other U.S. government partners, will continue to expose and combat the DPRK’s use of illicit activities – including cybercrime and cryptocurrency theft – to generate revenue for the regime,” the FBI statement continued.

The hackers made off with about 173,600 ether, according to the Ronin Network, and 25.5 million USDC, a stablecoin pegged to the U.S. dollar. Lazarus Group has allegedly been behind the theft of over $1 billion in crypto and cash over the years, becoming a successful source of revenue for North Korea’s heavily sanctioned economy.