This one for example is recent, just today, it is a Lazarus address that has entered a coinjoin round, on Arkham's website you can see their latest moves.

https://intel.arkm.com/explorer/entity/lazarus-group

bc1qjmgp7t34z63qm4l6umzqdcucd8umvmkszd8g4d

https://mempool.space/es/address/bc1qjmgp7t34z63qm4l6umzqdcucd8umvmkszd8g4d

Reply to this note

Please Login to reply.

Discussion

Thank you very much. So, supposedly the hacker uses a wallet that reuse addresses and then sends 0.2btc to a round.... It is so hard to believe.

That seemed very strange to me, is it possible that they are using the api directly?

It can be, idk. There are three clients and none of them have that wierd behavior.