Lazarus Group: North Korea's Crypto Army

On 21 February 2025, staff at Bybit, a Dubai-based crypto exchange, approved what looked like a routine transfer of ether from the company's deep storage. The screen they signed on had been tampered with. Within minutes about $1.46 billion had gone to a wallet controlled by hackers working for the government of North Korea. Five days later the FBI named the culprit: TraderTraitor, one of the units the world usually calls the Lazarus Group.

It was the largest theft in the history of crypto, and it was not a one-off. The blockchain analytics firm Chainalysis, which traces money through public crypto ledgers, puts North Korea's crypto thefts at a record $2.02 billion in 2025 and about $6.75 billion in total since it started counting. In 2026 the raids continued: the analytics firm Elliptic says North Korea's haul for the year passed $1 billion in September. No member of the group has ever stood in a courtroom, because the group is a branch of a state.

Who they are

Lazarus is not one person or one gang. It is the name security researchers gave to hacking teams run by North Korea's Reconnaissance General Bureau, the country's main military intelligence agency. Different firms use different labels for overlapping teams: APT38, Bluenoroff, Andariel, TraderTraitor, Jade Sleet. The US Treasury treats them as arms of the North Korean government and sanctioned Lazarus, Bluenoroff and Andariel on 13 September 2019, saying the hacking paid for "illicit weapon and missile programs".

Before crypto, the same teams were blamed for the 2014 hack of Sony Pictures, the theft of $81 million from Bangladesh's central bank in 2016 and the WannaCry ransomware outbreak of 2017. In September 2018 the US Justice Department charged one alleged member, Park Jin Hyok. In February 2021 it unsealed a second indictment adding two more, Jon Chang Hyok and Kim Il, accusing the three of conspiring to steal or extort more than $1.3 billion in cash and crypto. All three are believed to be in North Korea. None has been arrested.

The motive is plain. North Korea is cut off from the world's banks by United Nations sanctions over its nuclear and missile programmes. Crypto can be moved across borders without a bank, so stealing it is one of the few ways left to earn foreign money. A monitoring team set up by the United States and ten allies reported in October 2025 that the proceeds pay for weapons work, and that North Korean officials had used stablecoins (digital dollars that hold a fixed price) to buy military equipment and raw materials.

How they steal

The group rarely breaks code. It breaks people. Its favourite tool is spear-phishing: a personal, carefully researched message, such as a job offer or a business proposal, sent to the one employee who holds the keys. In crypto the keys are private keys, the secret codes that authorise payments, like the signature and PIN on a company bank account. Get them, or trick their holders into signing, and the money moves.

The Ronin heist of March 2022 shows the method. Ronin was a bridge, a service that holds coins on one blockchain and issues matching coins on another, much like a casino cage that keeps the dollars in its safe while handing out chips. It held the money behind the game Axie Infinity. A senior engineer at Sky Mavis, the company behind the game, was lured with a fake job offer and opened a booby-trapped document. That gave the hackers enough of the bridge's signing keys to take about $625 million. Nobody noticed for six days.

Other raids used a supply chain attack: instead of hitting the target, the hackers corrupt a supplier it trusts, the way a burglar might bribe the locksmith rather than force the door. At Bybit they broke into Safe{Wallet}, the outside service whose app Bybit used to approve large transfers, and changed what its screen showed. The signers saw a normal transfer and approved a hidden one. In September 2026 suspected North Korean hackers took $387.5 million from the exchange Bitget by feeding its own approval system forged paperwork; Bitget's chief executive, Gracy Chen, said no password or key was stolen.

The group also targets DeFi, short for decentralised finance: lending, trading and savings services run by smart contracts, code that moves money by itself without a bank or broker in the middle. In April 2026 hackers took about $295 million from Drift Protocol, a futures exchange on the Solana blockchain, after posing as a trading firm for six months; Mandiant, Google's incident-response unit, blamed a North Korean group. Weeks later $292 million was drained from Kelp DAO's bridge, a theft that LayerZero, the company whose messaging system the bridge used, attributed to Lazarus.

A third route is fake workers. North Korean IT staff apply for remote jobs under false names, collect salaries and sometimes plant themselves inside the companies they later rob. In 2026 one posed as a developer at Consensys and wrote code for MetaMask, the wallet app used by about 30 million people, for a month before he was caught.

Where the money goes

Stolen crypto is useless until it becomes cash, and the group launders it in industrial volume. First it swaps every token it can into plain bitcoin or ether. Then it passes the coins through mixers, services that pool many people's coins and pay out different ones, like dropping marked notes into a busy till and taking out unmarked ones. Tornado Cash, Blender and Sinbad were all sanctioned by the US Treasury for handling Lazarus money. It also uses cross-chain swap services such as THORChain to hop between blockchains, and finally over-the-counter brokers, many of them in China and Cambodia according to the allied monitoring team, who turn the coins into cash.

It works. After Bybit, the attackers converted most of the stolen ether through THORChain within a month, and by August 2026 Bybit said about 90 percent could no longer be traced. Of the $1.46 billion, Bybit has recovered about $48.4 million, with $30.5 million more frozen. Of Ronin's $625 million, police have recovered about $36 million. Of the $295 million taken from Drift, about $9.2 million is frozen.

Why nobody is in prison

Lazarus is the one entry on the Rap Sheet whose members cannot be arrested. The indicted hackers live in a country that does not extradite, and the rest have never been publicly identified. What enforcement exists hits the edges: sanctions on mixers, seizures of laundered coins, and prosecutions of people abroad who help. On 13 October 2026 the Justice Department announced arrests and raids on more than 40 suspected laptop farms in Texas, homes where Americans kept company laptops running for North Korean remote workers, and said at least 70 US companies had been infiltrated.

The thefts keep getting larger while the number of attacks falls. Chainalysis noted that North Korea stole more in 2025 than in 2024 from fewer incidents, by picking exchanges and bridges that hold hundreds of millions in one place. Drift, Kelp and Bitget in 2026 followed the same plan.