{"investigation":{"slug":"lazarus-group","entity_name":"Lazarus Group","trust_score":2,"severity_base":null,"score_modifier":-22,"confidence":0.85,"status":"draft","content_type":"investigation","summary":"Lazarus Group is a cyber threat actor that the U.S. Department of Justice, FBI, Treasury/OFAC, and the United Nations Panel of Experts have attributed to North Korea's Reconnaissance General Bureau (RGB), a military intelligence agency of the Democratic People's Republic of Korea (DPRK). U.S. and allied government agencies allege the group and its sub-units (tracked in industry reporting as APT38, BlueNoroff, TraderTraitor, and Stardust Chollima) have conducted destructive cyberattacks and large-scale cryptocurrency thefts since at least 2009, including what blockchain-analytics firm Chainalysis describes as a cumulative total exceeding $6 billion in stolen crypto assets, funds the UN Panel of Experts and U.S. officials allege support North Korea's weapons programs. This entry documents named individuals, government indictments, sanctions, and specific hacking incidents, distinguishing DOJ/FBI/OFAC/UN attributions from private-sector research findings.","sections":[{"content":"Lazarus Group is the name commonly used by cybersecurity researchers and Western governments for a set of North Korean state-linked hacking units. According to the U.S. Department of Justice, members of the group operate as part of the Reconnaissance General Bureau (RGB), a DPRK military intelligence agency. Industry and government reporting uses several overlapping names for sub-groups believed to conduct different types of operations, including APT38 (financially motivated operations), BlueNoroff, Stardust Chollima, and TraderTraitor (a campaign name used by CISA/FBI for cryptocurrency-focused intrusions). The DOJ's 2021 indictment states the defendants were 'members of units of the Reconnaissance General Bureau (RGB), a military intelligence agency of the DPRK,' engaged in 'criminal hacking.' Because North Korea does not cooperate with these investigations and the alleged individuals remain outside U.S. jurisdiction, attribution rests on DOJ charging documents, FBI and Treasury public statements, CISA technical advisories, and private blockchain-forensics research rather than any admission by North Korea, which has denied responsibility for cyberattacks attributed to it in the past.","heading":"Identity and State Sponsorship","sources":[{"url":"https://en.wikipedia.org/wiki/Lazarus_Group","name":"Lazarus Group — Wikipedia","type":"other","credibility":2},{"url":"https://www.justice.gov/usao-cdca/pr/3-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyber-attacks-and","name":"Three North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyber-attacks and Financial Crimes Across the Globe","type":"court_filing","credibility":1},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-108a","name":"AA22-108A: TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies","type":"regulatory","credibility":1}],"severity":"high"},{"content":"On February 17, 2021, the Department of Justice unsealed an indictment in the U.S. District Court for the Central District of California charging three men — Park Jin Hyok, Jon Chang Hyok, and Kim Il — identified as DPRK military intelligence operatives, with a wide-ranging conspiracy alleging destructive cyberattacks, theft and extortion of more than $1.3 billion in money and cryptocurrency, creation of malicious cryptocurrency applications, and fraudulent marketing of a blockchain platform. The indictment built on a criminal complaint against Park Jin Hyok unsealed in September 2018, which had alleged his involvement in the 2014 Sony Pictures Entertainment hack, the 2016 Bangladesh Bank theft, and the 2017 WannaCry ransomware attack. Park remains listed on the FBI's Cyber Most Wanted list. None of the three defendants is in U.S. custody; the charges are allegations that have not been tested at trial, and the individuals have not appeared in a U.S. court to respond to them.","heading":"DOJ Indictments and Named Individuals","sources":[{"url":"https://www.justice.gov/usao-cdca/pr/3-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyber-attacks-and","name":"3 North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyber-attacks and Financial Crimes Across the Globe","type":"court_filing","credibility":1},{"url":"https://www.fbi.gov/wanted/cyber/park-jin-hyok","name":"PARK JIN HYOK — FBI Wanted","type":"official","credibility":1},{"url":"https://www.npr.org/2021/02/17/968652939/justice-department-charges-3-north-korean-hackers-for-global-cyberattacks","name":"Justice Department Charges 3 North Korean Hackers For Global Cyberattacks","type":"news_article","credibility":1},{"url":"https://www.aljazeera.com/news/2021/2/17/us-charges-three-north-koreans-for-major-hacks-and-cyber-thefts","name":"US charges three North Koreans for major hacks and cyber-thefts","type":"news_article","credibility":1}],"severity":"critical"},{"content":"On or about February 21, 2025, cryptocurrency exchange Bybit was compromised in what the FBI has called the largest cryptocurrency theft on record, with approximately $1.5 billion in virtual assets stolen. According to FBI and IC3 public service announcement PSA I-022625-PSA (issued February 26, 2025), the attackers — tracked by the FBI under the name 'TraderTraitor,' which the Bureau associates with the DPRK — compromised a machine associated with a Bybit signer and manipulated the transaction-signing interface during a scheduled cold-to-hot wallet transfer to redirect funds to attacker-controlled addresses. The FBI stated the actors were converting stolen assets to Bitcoin and dispersing them across thousands of addresses on multiple blockchains for further laundering. Analytics firm TRM Labs and research organization CSIS have separately published analyses of the incident and its implications for exchange security and U.S. crypto policy. Chainalysis's 2026 crime report attributes $1.5 billion of North Korea's record $2.02 billion in 2025 crypto theft to the Bybit incident alone.","heading":"Bybit Exchange Hack — February 2025 (~$1.5 Billion)","sources":[{"url":"https://www.ic3.gov/psa/2025/psa250226","name":"North Korea Responsible for $1.5 Billion Bybit Hack (IC3 PSA I-022625-PSA)","type":"regulatory","credibility":1},{"url":"https://www.bleepingcomputer.com/news/security/fbi-confirms-lazarus-hackers-were-behind-15b-bybit-crypto-heist/","name":"FBI confirms Lazarus hackers were behind $1.5B Bybit crypto heist","type":"news_article","credibility":2},{"url":"https://www.csis.org/analysis/bybit-heist-and-future-us-crypto-regulation","name":"The ByBit Heist and the Future of U.S. Crypto Regulation","type":"research","credibility":2},{"url":"https://www.trmlabs.com/resources/blog/the-bybit-hack-following-north-koreas-largest-exploit","name":"The Bybit Hack: Following North Korea's Largest Exploit","type":"research","credibility":2},{"url":"https://www.coindesk.com/business/2025/12/18/north-korean-hackers-stole-a-record-usd2b-of-crypto-in-2025-chainalysis-says","name":"North Korea stole $2 billion in crypto in 2025, Chainalysis says","type":"news_article","credibility":2}],"severity":"critical"},{"content":"On March 23, 2022, an attacker compromised five of nine validator nodes securing the Ronin Bridge — an Ethereum sidechain underlying the Axie Infinity game — using social engineering rather than a code vulnerability, and withdrew 173,600 ETH and 25.5 million USDC. Initial reporting by blockchain-analytics firm Elliptic valued the theft at approximately $540 million; because the price of ETH rose in the days after the theft was disclosed (the breach was not publicly reported until roughly a week later), later figures — including those used by the U.S. Treasury Department and widely repeated in subsequent reporting — cite approximately $600–625 million. On April 14, 2022, the U.S. Treasury's Office of Foreign Assets Control (OFAC) sanctioned an Ethereum address it identified as belonging to Lazarus Group and tied to the theft, marking the U.S. government's formal public attribution of the Ronin hack to the group; CoinDesk and CNBC reported this attribution the same week. Chainalysis and Elliptic both published independent analyses attributing the hack to Lazarus Group and tracing subsequent laundering. Some later Treasury and press materials round the figure to $620 million; this entry treats the $540–625 million range as reflecting differing valuation dates and methodologies rather than a factual dispute over the quantity of assets withdrawn (173,600 ETH and 25.5 million USDC).","heading":"Ronin Bridge Hack — March 2022 (~$540M–$625M)","sources":[{"url":"https://www.elliptic.co/blog/540-million-stolen-from-the-ronin-defi-bridge","name":"North Korea's Lazarus Group identified as exploiters behind $540 million Ronin bridge heist","type":"research","credibility":2},{"url":"https://www.coindesk.com/policy/2022/04/14/us-officials-tie-north-korean-hacker-group-to-axies-ronin-exploit","name":"US Officials Tie North Korean Hacker Group to Axie's Ronin Exploit","type":"news_article","credibility":1},{"url":"https://www.chainalysis.com/blog/axie-infinity-ronin-bridge-dprk-hack-seizure/","name":"Crypto Community Makes Profiting Hard for North Korean Hackers (Ronin/Axie Infinity)","type":"research","credibility":2},{"url":"https://www.cnbc.com/2022/04/15/ronin-hack-north-korea-linked-to-615-million-crypto-heist-us-says.html","name":"Ronin hack North Korea linked to $615 million crypto heist, US says","type":"news_article","credibility":1},{"url":"https://www.coindesk.com/policy/2022/04/22/treasury-sanctions-more-north-korea-linked-eth-wallets-over-600m-ronin-hack","name":"US Treasury Sanctions More North Korea-Linked ETH Wallets Over $600M Ronin Hack","type":"news_article","credibility":1}],"severity":"critical"},{"content":"On June 24, 2022, the Horizon Bridge, a cross-chain bridge connecting the Harmony blockchain to Ethereum and Binance Smart Chain, was exploited for approximately $99.7 million after attackers compromised private keys held by validators. The FBI publicly confirmed on January 23, 2023 that Lazarus Group and APT38 (also tracked as BlueNoroff, Copernicium, and Stardust Chollima) were responsible, stating the intrusion leveraged the 'TraderTraitor' campaign that CISA had described in an April 2022 advisory. Blockchain analytics firm Elliptic reported that the stolen funds were laundered through Tornado Cash using patterns similar to those observed following the Ronin Bridge theft.","heading":"Harmony Horizon Bridge Hack — June 2022 (~$100 Million)","sources":[{"url":"https://www.fbi.gov/news/press-releases/fbi-confirms-lazarus-group-cyber-actors-responsible-for-harmonys-horizon-bridge-currency-theft","name":"FBI Confirms Lazarus Group Cyber Actors Responsible for Harmony's Horizon Bridge Currency Theft","type":"official","credibility":1},{"url":"https://www.elliptic.co/blog/analysis/fbi-confirms-north-korea-s-lazarus-group-as-hackers-behind-100-million-harmony-horizon-bridge-theft","name":"FBI confirms North Korea's Lazarus Group as hackers behind $100 million Harmony Horizon Bridge theft","type":"research","credibility":2},{"url":"https://www.cnbc.com/2023/01/24/north-korea-linked-hackers-behind-100-million-crypto-heist-fbi-says.html","name":"North Korea-linked hackers behind $100 million crypto heist, FBI says","type":"news_article","credibility":1}],"severity":"critical"},{"content":"Beginning on or about June 3, 2023, users of Atomic Wallet, a non-custodial crypto wallet application, reported drained wallets; initial estimates of roughly $35 million in losses were later revised upward. Blockchain analytics firm Elliptic reported that losses exceeded $100 million and attributed the theft to Lazarus Group, describing it as the first major crypto theft publicly attributed to the group since the Harmony Horizon Bridge hack a year earlier. Elliptic stated that stolen funds were routed through the Russia-based exchange Garantex, among other channels, and that it worked with exchanges and investigators to freeze a portion of the stolen assets. The FBI's September 2023 press release on the Stake.com theft separately corroborated DPRK responsibility for 'approximately $100 million of virtual currency from Atomic Wallet on or about June 2, 2023' as part of a broader pattern of 2023 thefts.","heading":"Atomic Wallet Hack — June 2023 (~$100 Million)","sources":[{"url":"https://www.elliptic.co/blog/analysis/north-korea-linked-atomic-wallet-heist-tops-100-million","name":"North Korea-linked Atomic Wallet heist tops $100 million","type":"research","credibility":2},{"url":"https://techcrunch.com/2023/06/08/north-korean-hackers-linked-to-atomic-wallet-crypto-hack/","name":"North Korean hackers linked to Atomic Wallet crypto hack","type":"news_article","credibility":1},{"url":"https://www.fbi.gov/news/press-releases/fbi-identifies-lazarus-group-cyber-actors-as-responsible-for-theft-of-41-million-from-stakecom","name":"FBI Identifies Lazarus Group Cyber Actors as Responsible for Theft of $41 Million from Stake.com","type":"official","credibility":1}],"severity":"critical"},{"content":"On July 18, 2024, Indian cryptocurrency exchange WazirX reported that approximately $234.9 million in digital assets was stolen from a multi-signature wallet operated under a third-party custody arrangement with Liminal Custody Solutions. Attackers are alleged to have altered the smart contract governing the multisig wallet when signatories accessed it, draining both hot and cold wallet holdings. WazirX attributed the breach to vulnerabilities at Liminal, a characterization Liminal disputed, saying the compromise originated on WazirX's side. According to a January 2025 joint statement by the governments of the United States, South Korea, and Japan, reported by BusinessToday and Business Standard, the three governments formally attributed the hack to North Korea's Lazarus Group. Blockchain analytics firm Crystal Intelligence and other researchers had earlier published technical analyses linking the exploit's on-chain patterns to prior Lazarus Group operations.","heading":"WazirX Exchange Hack — July 2024 (~$235 Million)","sources":[{"url":"https://en.wikipedia.org/wiki/2024_WazirX_hack","name":"2024 WazirX hack — Wikipedia","type":"other","credibility":2},{"url":"https://www.businesstoday.in/technology/news/story/north-koreas-lazarus-group-behind-235-million-wazirx-hack-confirms-joint-statement-by-us-south-korea-japan-460804-2025-01-14","name":"North Korea's Lazarus Group behind $235 million WazirX hack, confirms joint statement by US, South Korea, Japan","type":"news_article","credibility":2},{"url":"https://crystalintelligence.com/investigations/expert-analysis-wazirx-hack/","name":"Expert Analysis: How the $230m WazirX Hack Happened","type":"research","credibility":2}],"severity":"critical"},{"content":"The FBI has attributed several additional 2023 thefts to DPRK actors in the same September 2023 press release covering Stake.com: approximately $41 million from crypto casino and betting platform Stake.com on or about September 4, 2023, via compromise of internal withdrawal mechanisms; approximately $60 million combined from payment processors Alphapo and CoinsPaid on or about July 22, 2023; and the previously noted approximately $100 million from Atomic Wallet on or about June 2, 2023. The FBI stated DPRK cyber actors stole more than $200 million in cryptocurrency in 2023 alone. Chainalysis has separately published research attributing the 2020 KuCoin exchange breach — in which hackers drained an estimated $280 million from hot wallets before a large share was recovered or frozen — to Lazarus Group, though this attribution rests on private-sector blockchain analysis rather than a U.S. government indictment or sanctions action specific to that incident, and should be treated with correspondingly lower confidence than the FBI/DOJ-attributed incidents above.","heading":"Additional Attributed Crypto Thefts (Stake.com, Alphapo/CoinsPaid, KuCoin)","sources":[{"url":"https://www.fbi.gov/news/press-releases/fbi-identifies-lazarus-group-cyber-actors-as-responsible-for-theft-of-41-million-from-stakecom","name":"FBI Identifies Lazarus Group Cyber Actors as Responsible for Theft of $41 Million from Stake.com","type":"official","credibility":1},{"url":"https://www.theblock.co/post/249805/fbi-says-north-korea-linked-lazarus-group-was-responsible-for-41-million-theft-on-stake","name":"FBI says North Korea-linked Lazarus Group was responsible for $41 million theft on Stake","type":"news_article","credibility":2},{"url":"https://www.chainalysis.com/blog/lazarus-group-kucoin-exchange-hack/","name":"Lazarus Group KuCoin Exchange Hack — Chainalysis","type":"research","credibility":2}],"severity":"high"},{"content":"On April 18, 2026, liquid-restaking protocol KelpDAO was exploited for approximately $290 million in rsETH. According to an incident statement published by LayerZero Labs (whose infrastructure KelpDAO's cross-chain bridge relies on), the attacker compromised two LayerZero RPC (remote procedure call) nodes, fed falsified transaction data to the protocol's decentralized verifier network while DDoS-attacking legitimate RPC endpoints to force reliance on the compromised nodes, and caused the bridge to release unbacked rsETH before the intrusion malware self-deleted. LayerZero stated that 'preliminary indicators suggest attribution to a highly-sophisticated state actor, likely DPRK's Lazarus Group, more specifically TraderTraitor,' and noted that KelpDAO's use of a single-node ('1-of-1') verifier configuration — against LayerZero's stated recommendations — limited the damage to that one protocol. As of this writing, this attribution comes from the affected infrastructure provider's own incident report and has not yet been confirmed by the FBI, CISA, or OFAC in the way the Bybit, Ronin, Harmony, and Stake.com incidents were; it should be treated as an initial, unconfirmed attribution pending independent law-enforcement or Treasury action. Chainalysis and other outlets have described the incident as the largest DeFi loss of 2026 to date.","heading":"2026 Activity — Alleged KelpDAO / LayerZero Theft (~$290 Million)","sources":[{"url":"https://layerzero.network/blog/kelpdao-incident-statement","name":"KelpDAO Incident Statement — LayerZero","type":"official","credibility":2},{"url":"https://thedefiant.io/news/hacks/lazarus-kelpdao-290m-layerzero-rpc-hack-da50p3","name":"LayerZero Post Mortem Shows Lazarus Group Stole $290M From KelpDAO via RPC Node Compromise","type":"news_article","credibility":2},{"url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","name":"Inside the KelpDAO Bridge Exploit","type":"research","credibility":2},{"url":"https://www.upi.com/Top_News/World-News/2026/04/22/KelpDAO-LayerZero-North-Korea-crypto-hack-theft-Lazarus-Group/6151776848419/","name":"North Korean hackers tied to $290M crypto heist, firm says","type":"news_article","credibility":2}],"severity":"high"},{"content":"OFAC's Specially Designated Nationals (SDN) list includes a designation for Lazarus Group (SDN identifier referenced in OFAC's public sanctions search tool), part of a series of DPRK-related cyber sanctions dating to 2019. Following the Ronin Bridge theft, OFAC on April 14, 2022 sanctioned an Ethereum address it attributed to Lazarus Group, and later that month added further related addresses. On May 6, 2022, Treasury sanctioned virtual currency mixer Blender.io — the first-ever U.S. sanctions on a mixing service — citing its use by Lazarus Group to launder over $20.5 million of the roughly $620 million Axie Infinity/Ronin theft, per Treasury press release jy0768. In August 2022, OFAC sanctioned the Tornado Cash mixer, stating it had been used to launder more than $7 billion in virtual currency including funds tied to Lazarus Group; OFAC added 53 associated Ethereum addresses to the designation in November 2022. In March 2025, Treasury lifted the Tornado Cash sanctions following a November 2024 Fifth Circuit Court of Appeals ruling that found OFAC had exceeded its statutory authority in sanctioning immutable smart contracts; this ruling addressed the legal basis for sanctioning the protocol itself and did not disturb the underlying findings regarding Lazarus Group's alleged use of it. Separately, OFAC designated Tornado Cash co-founder Roman Semenov in August 2023, citing his alleged knowledge that Lazarus-linked addresses used the service.","heading":"OFAC Sanctions and Regulatory Designations","sources":[{"url":"https://sanctionssearch.ofac.treas.gov/Details.aspx?id=27307","name":"OFAC Sanctions List Search — Lazarus Group","type":"regulatory","credibility":1},{"url":"https://home.treasury.gov/news/press-releases/jy0768","name":"Treasury Sanctions Blender.io (press release jy0768)","type":"regulatory","credibility":1},{"url":"https://www.chainalysis.com/blog/tornado-cash-ofac-designation-sanctions/","name":"OFAC Sanctions Popular Ethereum Mixer Tornado Cash for Laundering Crypto Stolen by North Korea's Lazarus Group","type":"research","credibility":2},{"url":"https://www.mayerbrown.com/en/insights/publications/2024/12/federal-appeals-court-tosses-ofac-sanctions-on-tornado-cash-and-limits-federal-governments-ability-to-police-crypto-transactions","name":"Federal Appeals Court Tosses OFAC Sanctions on Tornado Cash","type":"news_article","credibility":2},{"url":"https://www.elliptic.co/blog/further-sanctions-against-north-koreas-lazarus-group-for-laundering-stolen-ronin-funds","name":"Further sanctions against North Korea's Lazarus Group for laundering stolen Ronin funds","type":"research","credibility":2}],"severity":"high"},{"content":"A joint cybersecurity advisory (AA22-108A), published by CISA, the FBI, and the U.S. Treasury Department, describes a campaign the agencies named 'TraderTraitor' and attribute to DPRK state-sponsored actors targeting blockchain and cryptocurrency companies since at least 2020. Per the advisory, intrusions typically begin with spearphishing messages sent to employees — often in system administration, DevOps, or software development roles — across various communication platforms, frequently posing as recruitment offers for high-paying jobs. Victims are lured into downloading trojanized cryptocurrency trading or price-prediction applications built from modified open-source code. CISA states targets have included cryptocurrency exchanges, DeFi protocols, play-to-earn games, trading firms, venture funds, and individual holders of large crypto or NFT balances. Elliptic and other analytics firms have published research describing an evolution in the group's laundering tradecraft over time, from direct use of centralized exchanges toward structured, automated use of mixers such as Tornado Cash and, following its sanctioning, other mixing and cross-chain bridging services; TRM Labs has documented specific fund flows through Tornado Cash following the Bybit theft.","heading":"Tactics, Techniques, and Procedures (TTPs)","sources":[{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-108a","name":"AA22-108A: TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies","type":"regulatory","credibility":1},{"url":"https://www.elliptic.co/insights/how-the-lazarus-group-is-stepping-up-crypto-hacks-and-changing-its-tactics/","name":"How the Lazarus Group is stepping up crypto hacks and changing its tactics","type":"research","credibility":2},{"url":"https://www.trmlabs.com/resources/blog/north-koreas-lazarus-group-moves-funds-through-tornado-cash","name":"North Korea's Lazarus Group Moves Funds Through Tornado Cash","type":"research","credibility":2}],"severity":"high"},{"content":"Prior to its focus on cryptocurrency, Lazarus Group was alleged by the DOJ and FBI to be responsible for several major, non-crypto intrusions. In November 2014, Sony Pictures Entertainment was breached in an attack the FBI attributed to North Korea, involving destructive 'wiper' malware, leaked internal data, and threats connected to the film 'The Interview.' In February 2016, attackers used fraudulent SWIFT messages to attempt to transfer nearly $1 billion from Bangladesh Bank's account at the Federal Reserve Bank of New York; roughly $81 million was successfully transferred to accounts in the Philippines before the remaining transactions were blocked, per Bangladesh Bank and U.S. court filings. In May 2017, the WannaCry ransomware worm — which the DOJ's indictment and the UK's National Cyber Security Centre attributed to North Korean actors — infected an estimated 300,000 computers across roughly 150 countries, encrypting files and demanding bitcoin ransoms; the U.S. DOJ's September 2018 complaint against Park Jin Hyok charged him in connection with all three incidents.","heading":"Historical Non-Crypto Operations (Sony, Bangladesh Bank, WannaCry)","sources":[{"url":"https://en.wikipedia.org/wiki/Bangladesh_Bank_robbery","name":"Bangladesh Bank robbery — Wikipedia","type":"other","credibility":2},{"url":"https://www.forbes.com/sites/thomasbrewster/2016/05/13/81m-bangladesh-bank-hackers-sony-pictures-breach/","name":"Crooks Behind $81M Bangladesh Bank Heist Linked To Sony Pictures Hackers","type":"news_article","credibility":1},{"url":"https://www.nccgroup.com/the-lazarus-group-north-korean-scourge-for-plus10-years/","name":"The Lazarus group: North Korean scourge for +10 years","type":"research","credibility":2},{"url":"https://www.aljazeera.com/amp/news/2018/9/6/north-korean-hacker-charged-with-sony-wannacry-attacks","name":"North Korean hacker charged with Sony, WannaCry attacks","type":"news_article","credibility":1}],"severity":"high"},{"content":"The United Nations Panel of Experts monitoring DPRK sanctions compliance (which operated until Russia vetoed the renewal of its mandate in early 2024) reported that North Korea generated a substantial share of its foreign currency income through cyber-enabled theft. Reporting on the panel's findings indicates it estimated North Korea stole approximately $3 billion through 58 cyberattacks on cryptocurrency-related platforms between 2017 and 2023, and was separately investigating 17 suspected 2023 thefts totaling roughly $750 million. Reuters and other outlets reporting on panel findings have cited a UN member-state estimate that illicit cyber activity funds a significant proportion — in some estimates roughly 40 to 50 percent — of North Korea's weapons of mass destruction and ballistic missile programs, though these percentage estimates originate from unnamed member-state intelligence assessments referenced in panel reports rather than from independently audited North Korean state finances, and should be treated as approximate. Following the panel's mandate lapse, the U.S. and allied governments formed a follow-on Multilateral Sanctions Monitoring Team to continue similar reporting.","heading":"UN Panel of Experts and Strategic Context","sources":[{"url":"https://therecord.media/north-korea-cryptocurrency-hacks-un-experts","name":"UN probing 58 alleged crypto heists by North Korea worth $3 billion","type":"news_article","credibility":2},{"url":"https://www.kharon.com/brief/u-n-highlights-escalating-north-korea-cryptocurrency-and-sanctions-evasion-activity","name":"U.N. Highlights Escalating North Korea Cryptocurrency and Sanctions Evasion Activity","type":"research","credibility":2},{"url":"https://www.malaymail.com/news/world/2021/02/10/north-korea-stole-us300m-in-crypto-to-fund-nukes-say-un-experts/1948613","name":"North Korea stole US$300m in crypto to fund nukes, say UN experts","type":"news_article","credibility":2}],"severity":"high"},{"content":"Blockchain analytics firm Chainalysis, in its year-end 2025 crypto crime report published in December 2025, stated that North Korean-linked hackers stole approximately $2.02 billion in cryptocurrency during 2025 — a record annual total and a 51 percent increase year-over-year — pushing its estimate of the group's cumulative theft since it began tracking such activity to approximately $6.75 billion. Chainalysis attributed the 2025 spike primarily to the February 2025 Bybit theft (~$1.5 billion) and noted that North Korean actors achieved larger individual thefts despite a marked decline in the total number of attacks, which the firm linked to a strategic shift toward fewer, higher-value targets and to schemes involving DPRK operatives posing as remote IT workers inside crypto firms. Because these cumulative figures aggregate many separate incidents with varying degrees of confirmed attribution — some backed by DOJ indictments or FBI/OFAC statements, others resting solely on private blockchain-forensic analysis — the precise cumulative dollar total should be treated as a research estimate rather than an audited figure.","heading":"Scale of Operations: Cumulative Theft Estimates","sources":[{"url":"https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2026/","name":"2025 Crypto Theft Reaches Record — Chainalysis","type":"research","credibility":2},{"url":"https://www.coindesk.com/business/2025/12/18/north-korean-hackers-stole-a-record-usd2b-of-crypto-in-2025-chainalysis-says","name":"North Korea stole $2 billion in crypto in 2025, Chainalysis says","type":"news_article","credibility":2},{"url":"https://thehackernews.com/2025/12/north-korea-linked-hackers-steal-202.html","name":"North Korea-Linked Hackers Steal $2.02 Billion in 2025, Leading Global Crypto Theft","type":"news_article","credibility":2}],"severity":"high"}],"timeline":[{"date":"2014-11","event":"Sony Pictures Entertainment is breached in a destructive cyberattack the FBI attributed to North Korea.","source":"NCC Group / DOJ filings","source_url":"https://www.nccgroup.com/the-lazarus-group-north-korean-scourge-for-plus10-years/"},{"date":"2016-02","event":"Attackers use fraudulent SWIFT messages to steal approximately $81 million from Bangladesh Bank's account at the New York Federal Reserve.","source":"Bangladesh Bank robbery — Wikipedia / Forbes","source_url":"https://en.wikipedia.org/wiki/Bangladesh_Bank_robbery"},{"date":"2017-05","event":"The WannaCry ransomware worm, later attributed by DOJ to North Korean actors, infects an estimated 300,000 computers across roughly 150 countries.","source":"DOJ indictment / Al Jazeera","source_url":"https://www.aljazeera.com/amp/news/2018/9/6/north-korean-hacker-charged-with-sony-wannacry-attacks"},{"date":"2018-09","event":"DOJ unseals a criminal complaint against Park Jin Hyok for the Sony, Bangladesh Bank, and WannaCry incidents.","source":"DOJ / Al Jazeera","source_url":"https://www.aljazeera.com/amp/news/2018/9/6/north-korean-hacker-charged-with-sony-wannacry-attacks"},{"date":"2019","event":"OFAC designates Lazarus Group on its Specially Designated Nationals list as part of DPRK cyber-related sanctions.","source":"Chainalysis / OFAC","source_url":"https://www.chainalysis.com/blog/tornado-cash-ofac-designation-sanctions/"},{"date":"2020","event":"KuCoin exchange is breached; roughly $280 million in crypto is drained from hot wallets, later attributed by Chainalysis to Lazarus Group.","source":"Chainalysis","source_url":"https://www.chainalysis.com/blog/lazarus-group-kucoin-exchange-hack/"},{"date":"2021-02-17","event":"DOJ unseals indictment charging Park Jin Hyok, Jon Chang Hyok, and Kim Il with a wide-ranging conspiracy to steal and extort over $1.3 billion.","source":"NPR / DOJ","source_url":"https://www.npr.org/2021/02/17/968652939/justice-department-charges-3-north-korean-hackers-for-global-cyberattacks","date_evidence":"On February 17, the Department of Justice released a newly unsealed indictment that charged three North Korean cyber operatives"},{"date":"2022-03","event":"The Ronin Bridge is exploited for 173,600 ETH and 25.5 million USDC (later valued at roughly $540–625 million).","source":"Elliptic","source_url":"https://www.elliptic.co/blog/540-million-stolen-from-the-ronin-defi-bridge","date_original":"2022-03-23"},{"date":"2022-04","event":"OFAC sanctions an Ethereum address it attributes to Lazarus Group in connection with the Ronin theft, the U.S. government's formal attribution of the hack.","source":"Elliptic / CoinDesk","source_url":"https://www.coindesk.com/policy/2022/04/14/us-officials-tie-north-korean-hacker-group-to-axies-ronin-exploit","date_evidence":"On April 14th, the US Treasury's Office of Foreign Assets Control (OFAC) announced new sanctions against the thief's Ethereum address and listed the owner of this address as Lazarus Group","date_original":"2022-04-14"},{"date":"2022-05","event":"Treasury sanctions the Blender.io mixer, the first U.S. sanctions on a virtual currency mixer, citing its use to launder Ronin theft proceeds.","source":"U.S. Treasury press release jy0768","source_url":"https://home.treasury.gov/news/press-releases/jy0768","date_original":"2022-05-06"},{"date":"2022-06","event":"Harmony's Horizon Bridge is exploited for approximately $99.7 million.","source":"Elliptic","source_url":"https://www.elliptic.co/blog/analysis/fbi-confirms-north-korea-s-lazarus-group-as-hackers-behind-100-million-harmony-horizon-bridge-theft","date_original":"2022-06-24"},{"date":"2022-08","event":"OFAC sanctions the Tornado Cash mixer, citing its use to launder over $7 billion including Lazarus Group-linked funds.","source":"Chainalysis","source_url":"https://www.chainalysis.com/blog/tornado-cash-ofac-designation-sanctions/"},{"date":"2023-01","event":"FBI publicly confirms Lazarus Group and APT38 as responsible for the Harmony Horizon Bridge theft.","source":"FBI press release","source_url":"https://www.fbi.gov/news/press-releases/fbi-confirms-lazarus-group-cyber-actors-responsible-for-harmonys-horizon-bridge-currency-theft","date_original":"2023-01-23"},{"date":"2023-06","event":"Atomic Wallet users report drained wallets; losses are later revised to over $100 million and attributed to Lazarus Group by Elliptic.","source":"Elliptic","source_url":"https://www.elliptic.co/blog/analysis/north-korea-linked-atomic-wallet-heist-tops-100-million","date_original":"2023-06-03"},{"date":"2023-07","event":"Approximately $60 million is stolen combined from payment processors Alphapo and CoinsPaid, later attributed by the FBI to DPRK actors.","source":"FBI press release","source_url":"https://www.fbi.gov/news/press-releases/fbi-identifies-lazarus-group-cyber-actors-as-responsible-for-theft-of-41-million-from-stakecom","date_original":"2023-07-22"},{"date":"2023-09","event":"Approximately $41 million is stolen from crypto betting platform Stake.com; the FBI attributes the theft to Lazarus Group.","source":"FBI press release","source_url":"https://www.fbi.gov/news/press-releases/fbi-identifies-lazarus-group-cyber-actors-as-responsible-for-theft-of-41-million-from-stakecom","date_original":"2023-09-04"},{"date":"2024-07-18","event":"WazirX exchange is exploited for approximately $234.9 million from a multisig wallet under third-party custody.","source":"2024 WazirX hack — Wikipedia","source_url":"https://en.wikipedia.org/wiki/2024_WazirX_hack","date_evidence":"On 18 July, 2024, WazirX, an Indian cryptocurrency exchange, reported a cyberattack in which approximately US$234.9 million...were stolen"},{"date":"2025-01","event":"The U.S., South Korea, and Japan issue a joint statement formally attributing the WazirX hack to North Korea's Lazarus Group.","source":"BusinessToday","source_url":"https://www.businesstoday.in/technology/news/story/north-koreas-lazarus-group-behind-235-million-wazirx-hack-confirms-joint-statement-by-us-south-korea-japan-460804-2025-01-14","date_original":"2025-01-14"},{"date":"2025-02-21","event":"Bybit exchange is compromised for approximately $1.5 billion in the largest cryptocurrency theft on record.","source":"FBI/IC3 PSA I-022625-PSA","source_url":"https://www.ic3.gov/psa/2025/psa250226","date_evidence":"theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange, Bybit, on or about February 21, 2025"},{"date":"2025-02-26","event":"FBI and IC3 issue a public service announcement formally attributing the Bybit theft to DPRK actor 'TraderTraitor.'","source":"FBI/IC3 PSA I-022625-PSA","source_url":"https://www.ic3.gov/psa/2025/psa250226","date_evidence":"Alert Number: I-022625-PSA / February 26, 2025"},{"date":"2025-03","event":"U.S. Treasury lifts sanctions on Tornado Cash following a Fifth Circuit Court of Appeals ruling limiting OFAC's authority to sanction immutable smart contracts.","source":"Mayer Brown legal analysis","source_url":"https://www.mayerbrown.com/en/insights/publications/2024/12/federal-appeals-court-tosses-ofac-sanctions-on-tornado-cash-and-limits-federal-governments-ability-to-police-crypto-transactions","date_original":"2025-03-21"},{"date":"2025-12","event":"Chainalysis reports North Korea-linked actors stole a record $2.02 billion in cryptocurrency in 2025, pushing cumulative estimated theft to $6.75 billion.","source":"Chainalysis / CoinDesk","source_url":"https://www.coindesk.com/business/2025/12/18/north-korean-hackers-stole-a-record-usd2b-of-crypto-in-2025-chainalysis-says"},{"date":"2026-04-18","event":"KelpDAO liquid-restaking protocol is exploited for approximately $290 million via compromise of LayerZero RPC infrastructure; LayerZero states preliminary attribution points to Lazarus Group/TraderTraitor.","source":"LayerZero incident statement","source_url":"https://layerzero.network/blog/kelpdao-incident-statement","date_evidence":"On April 18, 2026, KelpDAO was exploited for approximately $290M."}],"sources_used":[{"url":"https://en.wikipedia.org/wiki/Lazarus_Group","name":"Lazarus Group — Wikipedia","type":"other","archive_url":"http://web.archive.org/web/20260807131547/https://en.wikipedia.org/wiki/Lazarus_Group","credibility":2,"archive_timestamp":"2026-08-07T13:15:47+00:00"},{"url":"https://sanctionssearch.ofac.treas.gov/Details.aspx?id=27307","name":"OFAC Sanctions List Search — Lazarus Group","type":"regulatory","archive_url":"http://web.archive.org/web/20260412031219/https://sanctionssearch.ofac.treas.gov/Details.aspx?id=27307","credibility":1,"archive_timestamp":"2026-04-12T03:12:19+00:00"},{"url":"https://www.justice.gov/usao-cdca/pr/3-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyber-attacks-and","name":"3 North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyber-attacks and Financial Crimes Across the Globe","type":"court_filing","archive_url":"http://web.archive.org/web/20260611171805/https://www.justice.gov/usao-cdca/pr/3-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyber-attacks-and","credibility":1,"archive_timestamp":"2026-06-11T17:18:05+00:00"},{"url":"https://www.fbi.gov/wanted/cyber/park-jin-hyok","name":"PARK JIN HYOK — FBI Wanted","type":"official","archive_url":"http://web.archive.org/web/20260813152334/https://www.fbi.gov/wanted/cyber/park-jin-hyok","credibility":1,"archive_timestamp":"2026-08-13T15:23:34+00:00"},{"url":"https://www.npr.org/2021/02/17/968652939/justice-department-charges-3-north-korean-hackers-for-global-cyberattacks","name":"Justice Department Charges 3 North Korean Hackers For Global Cyberattacks","type":"news_article","archive_url":"http://web.archive.org/web/20260102101313/https://www.npr.org/2021/02/17/968652939/justice-department-charges-3-north-korean-hackers-for-global-cyberattacks","credibility":1,"archive_timestamp":"2026-01-02T10:13:13+00:00"},{"url":"https://www.aljazeera.com/news/2021/2/17/us-charges-three-north-koreans-for-major-hacks-and-cyber-thefts","name":"US charges three North Koreans for major hacks and cyber-thefts","type":"news_article","archive_url":"http://web.archive.org/web/20260218190418/https://www.aljazeera.com/news/2021/2/17/us-charges-three-north-koreans-for-major-hacks-and-cyber-thefts","credibility":1,"archive_timestamp":"2026-02-18T19:04:18+00:00"},{"url":"https://www.ic3.gov/psa/2025/psa250226","name":"North Korea Responsible for $1.5 Billion Bybit Hack (IC3 PSA I-022625-PSA)","type":"regulatory","archive_url":"http://web.archive.org/web/20260812004132/https://www.ic3.gov/psa/2025/psa250226","credibility":1,"archive_timestamp":"2026-08-12T00:41:32+00:00"},{"url":"https://www.bleepingcomputer.com/news/security/fbi-confirms-lazarus-hackers-were-behind-15b-bybit-crypto-heist/","name":"FBI confirms Lazarus hackers were behind $1.5B Bybit crypto heist","type":"news_article","archive_url":"http://web.archive.org/web/20260710224530/https://www.bleepingcomputer.com/news/security/fbi-confirms-lazarus-hackers-were-behind-15b-bybit-crypto-heist/","credibility":2,"archive_timestamp":"2026-07-10T22:45:30+00:00"},{"url":"https://www.csis.org/analysis/bybit-heist-and-future-us-crypto-regulation","name":"The ByBit Heist and the Future of U.S. Crypto Regulation","type":"research","archive_url":"http://web.archive.org/web/20260729222534/https://www.csis.org/analysis/bybit-heist-and-future-us-crypto-regulation","credibility":2,"archive_timestamp":"2026-07-29T22:25:34+00:00"},{"url":"https://www.trmlabs.com/resources/blog/the-bybit-hack-following-north-koreas-largest-exploit","name":"The Bybit Hack: Following North Korea's Largest Exploit","type":"research","archive_url":"http://web.archive.org/web/20260509172534/https://www.trmlabs.com/resources/blog/the-bybit-hack-following-north-koreas-largest-exploit","credibility":2,"archive_timestamp":"2026-05-09T17:25:34+00:00"},{"url":"https://www.elliptic.co/blog/540-million-stolen-from-the-ronin-defi-bridge","name":"North Korea's Lazarus Group identified as exploiters behind $540 million Ronin bridge heist","type":"research","archive_url":"http://web.archive.org/web/20260725004643/https://www.elliptic.co/blog/540-million-stolen-from-the-ronin-defi-bridge","credibility":2,"archive_timestamp":"2026-07-25T00:46:43+00:00"},{"url":"https://www.coindesk.com/policy/2022/04/14/us-officials-tie-north-korean-hacker-group-to-axies-ronin-exploit","name":"US Officials Tie North Korean Hacker Group to Axie's Ronin Exploit","type":"news_article","archive_url":"http://web.archive.org/web/20260327074815/https://www.coindesk.com/policy/2022/04/14/us-officials-tie-north-korean-hacker-group-to-axies-ronin-exploit","credibility":1,"archive_timestamp":"2026-03-27T07:48:15+00:00"},{"url":"https://www.chainalysis.com/blog/axie-infinity-ronin-bridge-dprk-hack-seizure/","name":"Crypto Community Makes Profiting Hard for North Korean Hackers","type":"research","archive_url":"http://web.archive.org/web/20260624211742/https://www.chainalysis.com/blog/axie-infinity-ronin-bridge-dprk-hack-seizure/","credibility":2,"archive_timestamp":"2026-06-24T21:17:42+00:00"},{"url":"https://www.cnbc.com/2022/04/15/ronin-hack-north-korea-linked-to-615-million-crypto-heist-us-says.html","name":"Ronin hack North Korea linked to $615 million crypto heist, US says","type":"news_article","archive_url":"http://web.archive.org/web/20260707194630/https://www.cnbc.com/2022/04/15/ronin-hack-north-korea-linked-to-615-million-crypto-heist-us-says.html","credibility":1,"archive_timestamp":"2026-07-07T19:46:30+00:00"},{"url":"https://www.coindesk.com/policy/2022/04/22/treasury-sanctions-more-north-korea-linked-eth-wallets-over-600m-ronin-hack","name":"US Treasury Sanctions More North Korea-Linked ETH Wallets Over $600M Ronin Hack","type":"news_article","archive_url":null,"credibility":1,"archive_timestamp":null},{"url":"https://www.fbi.gov/news/press-releases/fbi-confirms-lazarus-group-cyber-actors-responsible-for-harmonys-horizon-bridge-currency-theft","name":"FBI Confirms Lazarus Group Cyber Actors Responsible for Harmony's Horizon Bridge Currency Theft","type":"official","archive_url":"http://web.archive.org/web/20260822132114/https://www.fbi.gov/news/press-releases/fbi-confirms-lazarus-group-cyber-actors-responsible-for-harmonys-horizon-bridge-currency-theft","credibility":1,"archive_timestamp":"2026-08-22T13:21:14+00:00"},{"url":"https://www.elliptic.co/blog/analysis/fbi-confirms-north-korea-s-lazarus-group-as-hackers-behind-100-million-harmony-horizon-bridge-theft","name":"FBI confirms North Korea's Lazarus Group as hackers behind $100 million Harmony Horizon Bridge theft","type":"research","archive_url":"http://web.archive.org/web/20260519161602/https://www.elliptic.co/blog/analysis/fbi-confirms-north-korea-s-lazarus-group-as-hackers-behind-100-million-harmony-horizon-bridge-theft","credibility":2,"archive_timestamp":"2026-05-19T16:16:02+00:00"},{"url":"https://www.cnbc.com/2023/01/24/north-korea-linked-hackers-behind-100-million-crypto-heist-fbi-says.html","name":"North Korea-linked hackers behind $100 million crypto heist, FBI says","type":"news_article","archive_url":"http://web.archive.org/web/20260707194626/https://www.cnbc.com/2023/01/24/north-korea-linked-hackers-behind-100-million-crypto-heist-fbi-says.html","credibility":1,"archive_timestamp":"2026-07-07T19:46:26+00:00"},{"url":"https://www.elliptic.co/blog/analysis/north-korea-linked-atomic-wallet-heist-tops-100-million","name":"North Korea-linked Atomic Wallet heist tops $100 million","type":"research","archive_url":"http://web.archive.org/web/20260416044021/https://www.elliptic.co/blog/analysis/north-korea-linked-atomic-wallet-heist-tops-100-million","credibility":2,"archive_timestamp":"2026-04-16T04:40:21+00:00"},{"url":"https://techcrunch.com/2023/06/08/north-korean-hackers-linked-to-atomic-wallet-crypto-hack/","name":"North Korean hackers linked to Atomic Wallet crypto hack","type":"news_article","archive_url":"http://web.archive.org/web/20241001125019/https://techcrunch.com/2023/06/08/north-korean-hackers-linked-to-atomic-wallet-crypto-hack/","credibility":1,"archive_timestamp":"2024-10-01T12:50:19+00:00"},{"url":"https://www.fbi.gov/news/press-releases/fbi-identifies-lazarus-group-cyber-actors-as-responsible-for-theft-of-41-million-from-stakecom","name":"FBI Identifies Lazarus Group Cyber Actors as Responsible for Theft of $41 Million from Stake.com","type":"official","archive_url":"http://web.archive.org/web/20260823023924/https://www.fbi.gov/news/press-releases/fbi-identifies-lazarus-group-cyber-actors-as-responsible-for-theft-of-41-million-from-stakecom","credibility":1,"archive_timestamp":"2026-08-23T02:39:24+00:00"},{"url":"https://www.theblock.co/post/249805/fbi-says-north-korea-linked-lazarus-group-was-responsible-for-41-million-theft-on-stake","name":"FBI says North Korea-linked Lazarus Group was responsible for $41 million theft on Stake","type":"news_article","archive_url":"http://web.archive.org/web/20251117045911/https://www.theblock.co/post/249805/fbi-says-north-korea-linked-lazarus-group-was-responsible-for-41-million-theft-on-stake","credibility":2,"archive_timestamp":"2025-11-17T04:59:11+00:00"},{"url":"https://en.wikipedia.org/wiki/2024_WazirX_hack","name":"2024 WazirX hack — Wikipedia","type":"other","archive_url":"http://web.archive.org/web/20260823183557/https://en.wikipedia.org/wiki/2024_WazirX_hack","credibility":2,"archive_timestamp":"2026-08-23T18:35:57+00:00"},{"url":"https://www.businesstoday.in/technology/news/story/north-koreas-lazarus-group-behind-235-million-wazirx-hack-confirms-joint-statement-by-us-south-korea-japan-460804-2025-01-14","name":"North Korea's Lazarus Group behind $235 million WazirX hack, confirms joint statement by US, South Korea, Japan","type":"news_article","archive_url":"http://web.archive.org/web/20260511135218/https://www.businesstoday.in/technology/news/story/north-koreas-lazarus-group-behind-235-million-wazirx-hack-confirms-joint-statement-by-us-south-korea-japan-460804-2025-01-14","credibility":2,"archive_timestamp":"2026-05-11T13:52:18+00:00"},{"url":"https://crystalintelligence.com/investigations/expert-analysis-wazirx-hack/","name":"Expert Analysis: How the $230m WazirX Hack Happened","type":"research","archive_url":"http://web.archive.org/web/20260607181701/https://crystalintelligence.com/investigations/expert-analysis-wazirx-hack/","credibility":2,"archive_timestamp":"2026-06-07T18:17:01+00:00"},{"url":"https://www.chainalysis.com/blog/lazarus-group-kucoin-exchange-hack/","name":"Lazarus Group KuCoin Exchange Hack — Chainalysis","type":"research","archive_url":"http://web.archive.org/web/20260508084300/https://www.chainalysis.com/blog/lazarus-group-kucoin-exchange-hack/","credibility":2,"archive_timestamp":"2026-05-08T08:43:00+00:00"},{"url":"https://layerzero.network/blog/kelpdao-incident-statement","name":"KelpDAO Incident Statement — LayerZero","type":"official","archive_url":"http://web.archive.org/web/20260806181836/https://layerzero.network/blog/kelpdao-incident-statement","credibility":2,"archive_timestamp":"2026-08-06T18:18:36+00:00"},{"url":"https://thedefiant.io/news/hacks/lazarus-kelpdao-290m-layerzero-rpc-hack-da50p3","name":"LayerZero Post Mortem Shows Lazarus Group Stole $290M From KelpDAO via RPC Node Compromise","type":"news_article","archive_url":"http://web.archive.org/web/20260526151125/https://thedefiant.io/news/hacks/lazarus-kelpdao-290m-layerzero-rpc-hack-da50p3","credibility":2,"archive_timestamp":"2026-05-26T15:11:25+00:00"},{"url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","name":"Inside the KelpDAO Bridge Exploit","type":"research","archive_url":"http://web.archive.org/web/20260730015225/https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","credibility":2,"archive_timestamp":"2026-07-30T01:52:25+00:00"},{"url":"https://www.upi.com/Top_News/World-News/2026/04/22/KelpDAO-LayerZero-North-Korea-crypto-hack-theft-Lazarus-Group/6151776848419/","name":"North Korean hackers tied to $290M crypto heist, firm says","type":"news_article","archive_url":"http://web.archive.org/web/20260423075046/https://www.upi.com/Top_News/World-News/2026/04/22/KelpDAO-LayerZero-North-Korea-crypto-hack-theft-Lazarus-Group/6151776848419/","credibility":2,"archive_timestamp":"2026-04-23T07:50:46+00:00"},{"url":"https://home.treasury.gov/news/press-releases/jy0768","name":"Treasury Sanctions Blender.io (press release jy0768)","type":"regulatory","archive_url":"http://web.archive.org/web/20260709144205/https://home.treasury.gov/news/press-releases/jy0768","credibility":1,"archive_timestamp":"2026-07-09T14:42:05+00:00"},{"url":"https://www.chainalysis.com/blog/tornado-cash-ofac-designation-sanctions/","name":"OFAC Sanctions Popular Ethereum Mixer Tornado Cash for Laundering Crypto Stolen by North Korea's Lazarus Group","type":"research","archive_url":"http://web.archive.org/web/20260613003113/https://www.chainalysis.com/blog/tornado-cash-ofac-designation-sanctions/","credibility":2,"archive_timestamp":"2026-06-13T00:31:13+00:00"},{"url":"https://www.mayerbrown.com/en/insights/publications/2024/12/federal-appeals-court-tosses-ofac-sanctions-on-tornado-cash-and-limits-federal-governments-ability-to-police-crypto-transactions","name":"Federal Appeals Court Tosses OFAC Sanctions on Tornado Cash","type":"news_article","archive_url":"http://web.archive.org/web/20260417054354/https://www.mayerbrown.com/en/insights/publications/2024/12/federal-appeals-court-tosses-ofac-sanctions-on-tornado-cash-and-limits-federal-governments-ability-to-police-crypto-transactions","credibility":2,"archive_timestamp":"2026-04-17T05:43:54+00:00"},{"url":"https://www.elliptic.co/blog/further-sanctions-against-north-koreas-lazarus-group-for-laundering-stolen-ronin-funds","name":"Further sanctions against North Korea's Lazarus Group for laundering stolen Ronin funds","type":"research","archive_url":"http://web.archive.org/web/20260610034653/https://www.elliptic.co/blog/further-sanctions-against-north-koreas-lazarus-group-for-laundering-stolen-ronin-funds","credibility":2,"archive_timestamp":"2026-06-10T03:46:53+00:00"},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-108a","name":"AA22-108A: TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies","type":"regulatory","archive_url":"http://web.archive.org/web/20260611132247/https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-108a","credibility":1,"archive_timestamp":"2026-06-11T13:22:47+00:00"},{"url":"https://www.elliptic.co/insights/how-the-lazarus-group-is-stepping-up-crypto-hacks-and-changing-its-tactics/","name":"How the Lazarus Group is stepping up crypto hacks and changing its tactics","type":"research","archive_url":"http://web.archive.org/web/20260801132648/https://www.elliptic.co/insights/how-the-lazarus-group-is-stepping-up-crypto-hacks-and-changing-its-tactics/","credibility":2,"archive_timestamp":"2026-08-01T13:26:48+00:00"},{"url":"https://www.trmlabs.com/resources/blog/north-koreas-lazarus-group-moves-funds-through-tornado-cash","name":"North Korea's Lazarus Group Moves Funds Through Tornado Cash","type":"research","archive_url":"http://web.archive.org/web/20260607105623/https://www.trmlabs.com/resources/blog/north-koreas-lazarus-group-moves-funds-through-tornado-cash","credibility":2,"archive_timestamp":"2026-06-07T10:56:23+00:00"},{"url":"https://en.wikipedia.org/wiki/Bangladesh_Bank_robbery","name":"Bangladesh Bank robbery — Wikipedia","type":"other","archive_url":"http://web.archive.org/web/20260625202908/https://en.wikipedia.org/wiki/Bangladesh_Bank_robbery","credibility":2,"archive_timestamp":"2026-06-25T20:29:08+00:00"},{"url":"https://www.forbes.com/sites/thomasbrewster/2016/05/13/81m-bangladesh-bank-hackers-sony-pictures-breach/","name":"Crooks Behind $81M Bangladesh Bank Heist Linked To Sony Pictures Hackers","type":"news_article","archive_url":null,"credibility":1,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.nccgroup.com/the-lazarus-group-north-korean-scourge-for-plus10-years/","name":"The Lazarus group: North Korean scourge for +10 years","type":"research","archive_url":"http://web.archive.org/web/20260420215544/https://www.nccgroup.com/the-lazarus-group-north-korean-scourge-for-plus10-years/","credibility":2,"archive_timestamp":"2026-04-20T21:55:44+00:00"},{"url":"https://www.aljazeera.com/amp/news/2018/9/6/north-korean-hacker-charged-with-sony-wannacry-attacks","name":"North Korean hacker charged with Sony, WannaCry attacks","type":"news_article","archive_url":"https://web.archive.org/web/20260830131446/https://www.aljazeera.com/amp/news/2018/9/6/north-korean-hacker-charged-with-sony-wannacry-attacks","credibility":1,"archive_timestamp":"2026-08-30T13:14:46+00:00"},{"url":"https://therecord.media/north-korea-cryptocurrency-hacks-un-experts","name":"UN probing 58 alleged crypto heists by North Korea worth $3 billion","type":"news_article","archive_url":"http://web.archive.org/web/20260503100756/https://therecord.media/north-korea-cryptocurrency-hacks-un-experts","credibility":2,"archive_timestamp":"2026-05-03T10:07:56+00:00"},{"url":"https://www.kharon.com/brief/u-n-highlights-escalating-north-korea-cryptocurrency-and-sanctions-evasion-activity","name":"U.N. Highlights Escalating North Korea Cryptocurrency and Sanctions Evasion Activity","type":"research","archive_url":"http://web.archive.org/web/20260225232733/https://www.kharon.com/brief/u-n-highlights-escalating-north-korea-cryptocurrency-and-sanctions-evasion-activity","credibility":2,"archive_timestamp":"2026-02-25T23:27:33+00:00"},{"url":"https://www.malaymail.com/news/world/2021/02/10/north-korea-stole-us300m-in-crypto-to-fund-nukes-say-un-experts/1948613","name":"North Korea stole US$300m in crypto to fund nukes, say UN experts","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2026/","name":"2025 Crypto Theft Reaches Record — Chainalysis","type":"research","archive_url":"http://web.archive.org/web/20260821052023/https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2026/","credibility":2,"archive_timestamp":"2026-08-21T05:20:23+00:00"},{"url":"https://www.coindesk.com/business/2025/12/18/north-korean-hackers-stole-a-record-usd2b-of-crypto-in-2025-chainalysis-says","name":"North Korea stole $2 billion in crypto in 2025, Chainalysis says","type":"news_article","archive_url":"http://web.archive.org/web/20260801001208/https://www.coindesk.com/business/2025/12/18/north-korean-hackers-stole-a-record-usd2b-of-crypto-in-2025-chainalysis-says","credibility":2,"archive_timestamp":"2026-08-01T00:12:08+00:00"},{"url":"https://thehackernews.com/2025/12/north-korea-linked-hackers-steal-202.html","name":"North Korea-Linked Hackers Steal $2.02 Billion in 2025, Leading Global Crypto Theft","type":"news_article","archive_url":"http://web.archive.org/web/20260508232125/https://thehackernews.com/2025/12/north-korea-linked-hackers-steal-202.html","credibility":2,"archive_timestamp":"2026-05-08T23:21:25+00:00"}],"source_tags":["zachxbt"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-05-04T16:04:56.806495+00:00","updated_at":"2026-09-01T04:16:58.628756+00:00"}}