According to analysts from Elliptic, crypto assets that were stolen from the Atomic Wallet began to flow to the Sinbad service, popular with Lazarus Group hackers.

The first transactions began on the night of June 3rd. The process was then put on stream. Unknown persons withdrew assets from a specific user’s wallet to a new address, then exchanged them through decentralized exchanges like Sushiswap, Uniswap, MM Swaps and others. After the funds were withdrawn to a new address. The Elliptic team claimed to have traced $35 million stolen from Atomic Wallet.

Most of the funds were sent to the Sinbad cryptomixer. The platform has previously been used to launder crypto assets stolen by the North Korean hacker group Lazarus Group. Elliptic analysts did not specify the amount sent to the mixer, but noted that the funds were exchanged for bitcoins.

Meanwhile, Atomic Wallet CMO Roland Säde said the team is “doing everything we can to get the funds back.”

“Of course the team is devastated as we were very proud of our safety. We are working around the clock to resolve everything and get out of this crisis,” he added.

One Atomic Wallet user lost 1,897 ETH ($3.5 million). Also, the five largest wallets from which the hackers withdrew funds lost $9.7 million in total. The only way to protect assets for Atomic Wallet users is to transfer funds to new addresses, moreover, created using other software.

Hackers stole $16 million worth of cryptocurrencies in May, while unscrupulous developers stole at least $55 million from their users, according to a monthly report by PeckShield analysts.