Threat No. 1: How Lazarus Group targets crypto companies

​North Korean-linked hackers have stolen billions of dollars from the cryptocurrency industry in recent years. But one name appears in reports of cybercrime more often than most: Lazarus Group. How did a state-backed hacking operation turn the crypto market into a source of revenue, and why has it proved so difficult to stop?

Lazarus Group is typically portrayed as a single hacking group, but in practice, it is part of a much broader North Korean cyber operation. Different investigations have identified associated units and groups under names such as APT38, BlueNoroff, TraderTraitor, and other designations.

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

What sets Lazarus apart is its connection to the state. U.S. authorities link the group to North Korea's Reconnaissance General Bureau and believe the stolen funds help the country obtain foreign currency despite international sanctions.

Cryptocurrency has proved a particularly attractive target: large sums can be stolen remotely, moved rapidly across blockchains, and split among thousands of addresses.

From banks to crypto exchanges

Lazarus Group's history began long before digital assets became mainstream. The group was linked to the 2014 attack on Sony Pictures, while North Korean-linked hackers stole $81 million from Bangladesh's central bank through the SWIFT system in 2016.

The next turning point came as the cryptocurrency market expanded. Unlike traditional banks, crypto companies controlled vast amounts of liquid assets, operated around the clock, and often depended on a handful of employees, private keys, or transaction-signing systems.

One of the largest attacks was the March 2022 hack of Ronin Bridge. Approximately $620 million in assets was stolen from the system associated with Axie Infinity. The FBI later officially attributed the operation to Lazarus Group and APT38.

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

In June of the same year, Harmony's Horizon Bridge was attacked, resulting in losses of around $100 million. In 2023, Atomic Wallet, Alphapo, CoinsPaid, and Stake.com joined the list of victims, while Japan's DMM Bitcoin lost another $308 million in 2024.

Billions stolen in just a few years

The most high-profile incident occurred in February 2025, when Bybit lost approximately $1.5 billion. The FBI linked the theft to North Korea's TraderTraitor campaign. By the amount stolen, it became the largest single cryptocurrency theft in history.

Chainalysis estimated that North Korean-linked groups stole at least $2 billion in cryptocurrency in 2025 alone. By the end of that year, the cumulative total across previous years had reached $6.75 billion.

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

The attacks continued in 2026. Researchers linked major thefts from Drift Protocol and KelpDAO to North Korean actors, while the September Bitget hack pushed the amount stolen during the year above $1 billion.

Not every attack carried out by North Korean groups is officially attributed to Lazarus itself, and different names often refer to separate teams within the same state-backed system. It is therefore more accurate to say that North Korean-linked hackers had stolen more than $7 billion in cryptocurrency by autumn 2026, with Lazarus remaining one of the central components of that operation.

Hackers target people, not blockchains

Major Lazarus operations increasingly begin not with a smart contract vulnerability but with access to an employee or a company's internal systems. Fake recruiters contact developers through LinkedIn, send "test assignments," malicious files or repositories, and attempt to obtain credentials or access to work devices.

U.S. and Japanese authorities described precisely this approach following the DMM Bitcoin hack. An attacker posing as a recruiter contacted an employee of Ginco, a company associated with the exchange, and used social engineering to gain access to a system involved in processing transactions.

Another approach takes months to execute. North Korean IT workers secure jobs at legitimate crypto companies under false identities, gaining access to internal systems as employees.

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

According to TRM Labs, approximately 76% of the value stolen in the first half of 2026 resulted from compromises of internal systems and operational processes. Control over a private key, account, or transaction-signing system allows attackers to move funds without exploiting a vulnerability in the blockchain itself.

Stage two: Moving the stolen funds

Immediately after an attack, stolen assets are split among numerous addresses, exchanged through decentralized platforms, transferred between blockchains, and routed through services that make transactions harder to trace.

Following the Horizon Bridge hack, the FBI tracked the use of RAILGUN, while Lazarus used Tornado Cash in other operations and previously relied on Sinbad. When individual services faced sanctions or shut down, the laundering routes changed.

After the Bybit hack, the stolen assets were rapidly converted, distributed across thousands of addresses, and moved between blockchains.

A recent case shows how far this network extends beyond North Korea itself. ZachXBT claims that a Chinese criminal network helped launder more than $1 billion stolen by Lazarus across several attacks. Following the Bybit hack, the investigator infiltrated the network by posing as a customer and linked individual operators to millions of dollars in stolen funds.

Why Lazarus remains a systemic threat

Blocking a single wallet or service rarely stops Lazarus. Behind one cluster of addresses may be new intermediaries, employees operating under false identities, laundering networks, and a system that depends on a steady flow of funds.U.S. authorities directly link revenue from these operations to North Korean programs, including the development of ballistic missiles and nuclear weapons. For a regime facing severe sanctions, the cryptocurrency industry has become one way to obtain foreign currency without access to the conventional international financial system.

This also changes security requirements. Exchanges and DeFi projects can no longer rely solely on smart contract audits. They must also monitor recruitment, employee devices, access permissions, transaction-signing systems, and third-party contractors.

At the same time, every major theft increases pressure on services that can also serve legitimate purposes. Mixers, bridges, and decentralized exchanges face sanctions and regulatory scrutiny when hundreds of millions of dollars linked to North Korea pass through them.

Over the past several years, Lazarus has evolved from one of many hacking groups into a systemic threat to the cryptocurrency industry. Its advantage lies not in any single sophisticated vulnerability but in its ability to combine social engineering, internal access, technical attacks, and international money laundering into a coordinated operation.

The scale of the problem can therefore no longer be measured solely in billions of dollars stolen. As long as crypto companies remain convenient targets for accessing liquid digital assets, and networks exist to move and launder stolen funds, Lazarus attacks will remain a persistent threat to the entire industry rather than isolated incidents.