Bitcoin layer-2 developer Alex Lab believes the $4 million exploit it suffered in May is most likely linked to the notorious North Korean hacking consortium Lazarus Group. 

In a June 25 post to X, Alex Lab drew attention to three wallet addresses hackers used on May 16 to drain funds from the Bitcoin-based decentralized finance (DeFi) protocol.

Additionally, the team shared they collaborated with independent blockchain sleuth ZachXBT to compile the evidence required to link Lazarus to the exploit.

On May 16, Alex Lab notified users on X that attackers had exploited its BNB Smart Chain bridge, siphoning off around $4.3 million worth of funds in the process. 

The hackers also exploited around $13.7 million worth of the Stacks (STX) token however some of the exploited funds were sent to centralized exchanges and were subsequently frozen by the exchanges. 

On June 20, Alex Lab shared the attacker had broadcasted more than 11,800 STX transactions, using several DeFi protocols and bridges including Arkadiko, Bitflow and Allbridge to offramp the stolen STX. 

At the time, the team shared the exploit involved hackers gaining access to the team’s private keys. However, the team assured users that the smart contracts of the Alex Protocol itself were never compromised.

Related: Alex Labs rolls out post-exploit recovery plan

The team offered the attackers a 10% bounty for the return of 90% of the stolen funds and promised not to continue legal action if the funds were returned.

The attackers did not respond to Alex Lab’s bounty request.

The price of the Bitcoin Layer-2 protocol’s native ALEX token has slumped 10% in the last week and is down 47% over the last month. It is currently trading for $0.07.

Magazine — ‘Bitcoin Layer 2s’ aren’t really L2s at all: Here’s why that matters