What is the Lazarus Group in crypto?

The Lazarus Group is a North Korean state-sponsored hacking group that has become the best-known name in crypto theft. The label comes from the private cybersecurity industry, and US agencies use it alongside related names such as APT38, Bluenoroff and TraderTraitor. This guide explains who the group is, which crypto hacks officials have tied to it, and why its name keeps coming up.

Who is the Lazarus Group?

On September 13, 2019, the US Treasury's Office of Foreign Assets Control sanctioned three North Korean hacking groups known as Lazarus Group, Bluenoroff and Andariel. Treasury said all three are controlled by the Reconnaissance General Bureau, North Korea's primary intelligence agency, which is itself under US and United Nations sanctions. Treasury said the groups' cyberattacks help fund the country's weapons and missile programs. Because of those sanctions, dealing with addresses tied to the group can create legal problems, as described in what OFAC crypto sanctions are.

What crypto hacks is the Lazarus Group linked to?

In April 2022 the FBI said its investigation confirmed that Lazarus Group and APT38, cyber actors associated with North Korea, were responsible for the theft of $620 million in ether reported on March 29 of that year. That was the attack on the Ronin network behind the game Axie Infinity.

In February 2025 the FBI said North Korea was responsible for the theft of about $1.5 billion from the exchange Bybit on or about February 21. It called that specific activity TraderTraitor. The full list of the largest thefts is in what the biggest crypto hack is.

On October 29, 2026, Binance reported a theft of about $6.3 billion. Euronews reported that investigators were looking at several factors, including a compromised DevOps engineer's laptop, and that signs pointed to a North Korean group. On October 31 the FBI confirmed it, attributing the theft to TraderTraitor and publishing hundreds of addresses it asked services to block, CoinDesk reported. Binance itself has not named the attacker.

How does the Lazarus Group launder stolen crypto?

After the Bybit theft, the FBI said the attackers moved quickly, converting some stolen assets to bitcoin and other coins spread across thousands of addresses on several blockchains, with the aim of eventually turning them into cash. The FBI published Ethereum addresses linked to the theft and asked exchanges, bridges, node operators and other services to block transactions tied to them. Tools that obscure the trail, such as crypto mixers, are often part of this process, while public ledgers still let investigators trace funds.

Why does the Lazarus Group target crypto?

US officials say the thefts raise money for a heavily sanctioned government. Exchanges and bridges hold large pools of coins in internet-connected systems, so a single successful break-in can move hundreds of millions of dollars in minutes, and the attacks often begin with tricking an employee rather than breaking code.

Figures and attributions are as reported by officials and news outlets at the time and may be revised.