Edit: Lazarus Group — CryptoScamsWiki

Title / name *

Summary *

Category *

Scam type *

Severity *

Chain

Token

Amount lost (USD)

Image

Upload

Paste a link or upload a file (max 5 MB).

Details (Markdown supported)

> **On attribution:** "Lazarus Group" is a label applied by governments and security firms to overlapping North Korean state hacking units. Attributions below are those of the cited authorities (FBI, U.S. Treasury, DOJ, UN) and analytics firms (Chainalysis, Elliptic, Mandiant); cyber-attribution is rarely 100% certain. See the linked case entries for incident-specific findings.

## Overview

Lazarus Group is the most common name for a set of state-sponsored hacking units operated by North Korea's military-intelligence agency, the Reconnaissance General Bureau (RGB). When the U.S. Treasury sanctioned it in September 2019, it listed numerous aliases used across the security industry, including Hidden Cobra, Guardians of Peace, APT-C-26, Group 77, Office 91, ZINC, and TEMP.Hermit. The same action sanctioned two RGB sub-groups, Bluenoroff (a.k.a. APT38) and Andariel. [1]

## Structure and sub-units

Researchers track several overlapping clusters under the Lazarus/RGB umbrella:

- **Bluenoroff / APT38** — focused on financial theft (banks, exchanges). [1][2]
- **Andariel** — espionage plus revenue generation. [1]
- **TraderTraitor** (Jade Sleet / UNC4899) — recent exchange mega-thefts (see its own entry).
- **Contagious Interview / UNC4736** (AppleJeus, Citrine Sleet) — fake-recruiter malware (see its own entry).

A February 2021 U.S. indictment alleged these RGB units operated as "a single conspiracy." [2]

## Early operations (pre-crypto)

Lazarus is linked to a string of landmark intrusions: the 2014 Sony Pictures Entertainment hack; the February 2016 Bangladesh Bank heist, in which attackers used compromised SWIFT credentials to issue 35 fraudulent transfer requests totaling ~$951 million (most were blocked, but ~$81 million was taken and laundered through Philippine casinos); and the 2017 WannaCry ransomware outbreak. The Bangladesh heist marked a turning point — a nation-state stealing for profit. [2][6]

## Pivot to cryptocurrency

From around 2017, Lazarus increasingly targeted cryptocurrency. Campaigns such as "AppleJeus" distributed trojanized trading apps, and the group went after exchanges, cross-chain bridges, DeFi protocols, wallet software, and individual holders. U.S. and UN officials assess the proceeds fund North Korea's nuclear-weapons and ballistic-missile programs. [1][2][4]

## Major crypto thefts (selected)

- **2020 — KuCoin** (~$281M) [8]
- **2022 — Ronin / Axie Infinity bridge** (~$625M; then the largest crypto theft ever)
- **2022 — Harmony Horizon bridge** (~$100M)
- **2023 — Atomic Wallet** (~$100M+); also Stake.com, CoinsPaid, and Alphapo [7]
- **2024 — WazirX** (~$230M+) and **DMM Bitcoin** (~$305M); **Radiant Capital** (~$50M, via the UNC4736 cluster)
- **2025 — Bybit** (~$1.5B; the largest crypto theft in history) [3]

(Several of these are documented as their own entries and linked from this page.)

## Money laundering

Stolen funds are typically obfuscated through mixers (e.g. Tornado Cash, Blender, Sinbad), cross-chain bridges, swaps into Bitcoin, and Chinese-language over-the-counter (OTC) brokers, often over a roughly 45-day cash-out window. OFAC has sanctioned facilitators, including two Chinese nationals who laundered proceeds of a 2018 exchange intrusion, and venues such as Garantex. [1][5][7]

## Scale and impact

Chainalysis estimates DPRK-linked actors stole about $660.5 million across 20 incidents in 2023, roughly $1.34 billion across 47 incidents in 2024 (about 61% of all crypto stolen that year), and at least $2.02 billion in 2025 — bringing the lower-bound cumulative estimate for DPRK crypto theft to around $6.75 billion. In 2025, DPRK actors accounted for a record ~76% of service-level compromises, favoring rare but massive attacks. [4][5]

## Sanctions and indictments

The U.S. Treasury sanctioned Lazarus Group, Bluenoroff, and Andariel in September 2019. The DOJ charged RGB officer Park Jin Hyok in a 2018 complaint (Sony, WannaCry, Bangladesh Bank), and in February 2021 unsealed an indictment adding Jon Chang Hyok and Kim Il, alleging a conspiracy to steal and extort more than $1.3 billion in cash and cryptocurrency. All three remain at large on the FBI's Cyber Most Wanted list. [1][2][3]

_Bracketed numbers refer to the numbered sources listed below._

Aliases (one per line)

Wallets (chain:address per line)

Propose an edit