As crazy things are Lazarus has ended up using Wabisabi, it's a pity that the Whirpool coordinator is not there, it would have been a curious choice. If I were Lazarus I would have used Wabisabi since it manages identities at the network level, which whirpool does not and I would have needed thousands of whirpool clients to achieve the same anonymity.
It doesn't matter if you do coinjoin if your attacker knows to which ip those Bitcoins go even if it is a Tor ip, in that case they are correlated again and we know that those Bitcoins belong to a single entity.
Lazarus has all the 3 letter agencies behind them, it's not a trivial decision.
https://blog.wasabiwallet.website/explaining-wasabi-wallets-tor-implementation/index.html
