North Korean cybercriminals stole over $100 million in cryptocurrency from a leading exchange and laundered part of the proceeds using a blacklisted mixer, according to a U.S. blockchain analytics firm, underscoring the difficulty of enforcing sanctions on decentralized crypto tools.

The Lazarus Group orchestrated the theft of $112.5 million worth of cryptocurrency from the HTX exchange and its cross-chain bridge used to transfer assets in November, Elliptic said in a blog post on Thursday, backing up claims by independent cryptocurrency sleuths on social media last year.

Elliptic linked the attack on HTX and its HECO Bridge