EigenWallet: How BTC–XMR Atomic Swaps Help North Korean Groups Launder Stolen Crypto

Professional hacking groups increasingly use not only traditional mixers but also decentralized mechanisms for exchanging Bitcoin for Monero to conceal stolen assets. In several investigations, this activity has been linked to groups commonly attributed to the North Korean cluster, including Lazarus Group and affiliated operators.

EigenWallet, formerly known as UnstoppableSwap, is one recurring component of this infrastructure. The platform enables atomic BTC-to-XMR swaps without a centralized exchange or standard customer-identification procedures. Match Systems specialists analyzed this infrastructure and identified the principal liquidity-provision models behind these swaps.

How EigenWallet works

EigenWallet is a non-custodial platform for atomic swaps between Bitcoin and Monero. Its infrastructure can also be accessed through the Tor network, making it more difficult to establish users’ locations and identities.

In a conventional exchange, a user transfers assets to a centralized service that accepts one cryptocurrency and sends another. In an atomic swap, the exchange takes place directly between the parties through a dedicated cryptographic protocol. The transaction either executes in full or is cancelled: neither party can receive the assets without fulfilling its side of the trade.

This architecture reduces reliance on a centralized intermediary but creates serious investigative challenges. EigenWallet does not hold user funds in the conventional sense and is not the sole counterparty to every transaction. Independent participants supply liquidity, and each may use its own infrastructure and reserve-replenishment method.

For an illicit actor, the process is straightforward: BTC is sent to a one-time atomic-swap deposit address, after which the actor receives XMR. There is no direct transactional link between Bitcoin and Monero, while subsequent XMR movement is obscured by Monero’s native privacy mechanisms.

Principal liquidity-provision models

Match Systems’ analysis found that outwardly identical BTC-to-XMR swaps can be backed by different liquidity providers. At least six principal models have been identified for processing received BTC and subsequently replenishing XMR reserves.

The first model uses Lightning Network and major centralized exchanges. BTC received through atomic swaps is split into smaller lots and sent into Lightning Network. Payment channels are opened for this purpose, and the funds are then processed primarily through Lightning nodes linked to OKX and Kraken. These centralized exchanges are presumably used to convert BTC arriving through Lightning Network and replenish the XMR inventory needed for new swaps. In one analyzed dataset, this model accounted for most EigenWallet activity.

The second model uses specialized decentralized infrastructure to acquire XMR. The liquidity provider routes received BTC through the MayaChain cross-chain protocol and LiFi infrastructure before moving the assets into the Hyperliquid ecosystem. A specialized service is then used to acquire Monero without directly interacting with a conventional centralized exchange. Attribution becomes harder because the flow is distributed across multiple protocols, blockchains, and technical addresses.

The third model involves Wasabi Wallet, Hyperliquid, and KuCoin. Received BTC first enters Wasabi Wallet, where the direct link between incoming and outgoing transactions is disrupted. Demixing performed by Match Systems analysts indicates with high probability that, after leaving the mixer, funds reach Hyperliquid in 0.1–0.25 BTC lots and are exchanged for USDT on Arbitrum One. The assets are then transferred to KuCoin in batches of approximately 10,000–15,000 USDT. XMR is presumably acquired there to replenish liquidity for subsequent atomic swaps.

The fourth model uses THORChain, Litecoin, and a popular instant-exchange service. BTC is split into small amounts worth approximately $2,000–3,000 and exchanged for LTC through THORChain. Chains of more than 20 sequential Litecoin transactions are then created, with the funds sent to an instant-exchange service to purchase XMR. Confirmation is accelerated through CPFP, or Child Pays for Parent. The final transaction carries a higher fee, encouraging miners to include the entire package of linked unconfirmed transactions in one block. As a result, the transaction of interest becomes visible to analysts almost simultaneously with confirmation, when the corresponding instant-exchange order is already being processed. The operator also uses separate sessions, proxy IP addresses, and one-time XMR addresses for each exchange.

The fifth model uses the Remitano exchange and NEAR Intents infrastructure. Both services perform the same function: converting BTC received from atomic swaps into assets on BNB Smart Chain, primarily BTCB as well as ETH and USDT. Some funds pass through Remitano and some through NEAR Intents before converging on a single MEXC deposit address. The exchange is presumably used to acquire XMR and restore the liquidity required for new atomic swaps.

The sixth model follows a simpler route through THORChain and then to KuCoin. The exchange is likewise likely used to acquire XMR and replenish liquidity.

These models concern the principal liquidity providers capable of processing individual atomic swaps of 1 BTC or more. The EigenWallet ecosystem also includes smaller providers that handle lower amounts.

Why these schemes are difficult to stop

The central problem is the distributed nature of the infrastructure. EigenWallet provides the technical atomic-swap mechanism, while independent participants supply the actual liquidity. One provider uses Lightning Network, another a mixer and Hyperliquid, and a third THORChain and chains of LTC transactions.

Blocking one route therefore does not stop the entire system. A provider can change the sequence of services, select another blockchain, or redistribute liquidity across several venues. One-time addresses, Tor, proxy servers, and the small size of individual transactions further reduce the time available to respond.

A new challenge for blockchain analytics

EigenWallet illustrates how cryptocurrency-laundering infrastructure is changing. Instead of a single centralized exchanger, a network of independent liquidity providers emerges, each using its own combination of mixers, bridges, DEX protocols, and exchanges.

Under these conditions, finding only the atomic-swap deposit address is not enough. Investigators must identify the specific liquidity provider, establish its operational addresses, and determine how it acquires XMR for subsequent trades.

Match Systems notes that liquidity-replenishment points—centralized exchanges, instant-exchange services, and certain cross-chain protocols—remain potentially vulnerable elements in these schemes. Successful fund freezes, however, require near-instant transaction detection and rapid coordination among analytics companies, exchange services, and law-enforcement agencies.

As atomic swaps gain popularity, professional cybercriminal groups are likely to use platforms of this kind more frequently. Investigations must therefore move beyond isolated transactions and examine the entire liquidity economy that enables stolen BTC to be exchanged for privacy assets.