As crazy things are Lazarus has ended up using Wabisabi, it's a pity that the Whirpool coordinator is not there, it would have been a curious choice. If I were Lazarus I would have used Wabisabi since it manages identities at the network level, which whirpool does not and I would have needed thousands of whirpool clients to achieve the same anonymity.
It doesn't matter if you do coinjoin if your attacker knows to which ip those Bitcoins go even if it is a Tor ip, in that case they are correlated again and we know that those Bitcoins belong to a single entity.
Lazarus has all the 3 letter agencies behind them, it's not a trivial decision.
https://blog.wasabiwallet.website/explaining-wasabi-wallets-tor-implementation/index.html
I'm curious where this claim come from. Do you have any real/verificable source?
I can see that the coordinator with highest number of participants didn't have any significant increase in the number of fresh bitcoin for a long time.
Source: https://liquisabi.com/
This one for example is recent, just today, it is a Lazarus address that has entered a coinjoin round, on Arkham's website you can see their latest moves.
https://intel.arkm.com/explorer/entity/lazarus-group
bc1qjmgp7t34z63qm4l6umzqdcucd8umvmkszd8g4d
https://mempool.space/es/address/bc1qjmgp7t34z63qm4l6umzqdcucd8umvmkszd8g4d
Thank you very much. So, supposedly the hacker uses a wallet that reuse addresses and then sends 0.2btc to a round.... It is so hard to believe.
