Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #1[disputed][awaiting moderator]in section: 2023 Fund Movement

   “Transfers were reportedly executed in batches of approximately 5,000 ETH, occurring between 8:54 PM and 9:18 PM UTC.”

   reviewerThe January 2023 movement was executed in ~5,000 ETH batches between 8:54 PM and 9:18 PM UTC.The batch and time-window detail belongs to the December 2024 consolidation. The sentence appears to attribute it to 2023 in error, so it is proposed for removal.
   citedcryptonews.net/news/security/19857195/www.chainalysis.com/blog/blockchain-bandit-2023/

No source the reviewer could reach confirms or contradicts the claim.

1. #2[unverifiable][awaiting moderator]in section: 2023 Fund Movement

   “noting that Ether had risen approximately 33% and Bitcoin approximately 39% year-to-date at the time”

   reviewerChainalysis attributed the timing to Ether up ~33% and Bitcoin ~39% year-to-date.The cited Chainalysis post has no 33% or 39% figures. They may come from another outlet, but I did not find them.
   citedwww.chainalysis.com/blog/blockchain-bandit-2023/
2. #3[unverifiable][awaiting moderator]in section: 2023 Fund Movement

   “ZachXBT, an independent on-chain investigator, also flagged this activity across public channels.”

   reviewerZachXBT flagged the January 2023 movement.ZachXBT is documented as the source for the December 2024 move, not for 2023. The 2023 attribution is not supported by the cited source.
   citedwww.chainalysis.com/blog/blockchain-bandit-2023/
3. #4[unverifiable][awaiting moderator]in the timeline

   “flagged by Chainalysis and ZachXBT”

   reviewerTimeline: the 2023 movement was flagged by Chainalysis and ZachXBT.The Chainalysis part and the amounts and dates are confirmed. The ZachXBT part is unsupported.
   citedwww.chainalysis.com/blog/blockchain-bandit-2023/
4. #7[unverifiable][awaiting moderator]in the timeline

   “Blockchain Bandit activity peaks; actor begins systematically draining Ethereum wallets derived from 732 compromised private keys across 49,060 transactions.”

   reviewerBlockchain Bandit activity peaked in 2016.The cited source is dead, and I found no source for a peak year of 2016. The 732 and 49,060 figures are corroborated elsewhere, but not their attachment to 2016 as a start or peak.
   citedwww.ise.io/casestudies/ethercombing/index.html
5. #8[unverifiable][awaiting moderator]in the timeline

   “Blockchain Bandit's active exploitation campaign largely ceases; wallets enter dormancy.”

   reviewerCampaign ceased and wallets entered dormancy on 2018-12-31.The specific 2018-12-31 date looks like a placeholder. The cited article gives no such date. The summary and sections also say activity began around 2015, while this source says 2016.
   citedcointelegraph.com/news/blockchain-bandit…ears-of-dormancy

A cited source no longer resolves or no longer says what the page attributes to it.

1. #6[link rot][awaiting moderator]in section: Background and Discovery

   “https://www.ise.io/casestudies/ethercombing/index.html”

   reviewerISE primary source URL is live and supports the page's ISE-derived figures (732 keys, 49,060 transactions, 37,926 ETH, 13,319 ETH, etc.).The ISE URL is dead. The same URL is cited in sections 0, 1, 2 and 6 and in timeline entries 1, 2 and 4. I found no live replacement that I fetched, so this finding proposes no replacement URL. A moderator should re-point it to the securityevaluators.com copy. The 732 and 49,060 figures are corroborated by secondary coverage.
   citedwww.ise.io/casestudies/ethercombing/index.html

The cited evidence supports part of the claim but not all of it.

1. #11[partially supported][awaiting moderator]in section: Identity and Attribution

   “However, no formal attribution connecting the Blockchain Bandit specifically to the Lazarus Group or any other named actor has been published by a government authority or primary investigative source.”

   reviewerIdentity unknown and no official attribution to Lazarus Group.I found no official attribution. The assertion of 'behavioral and tactical similarities' with Lazarus is cited only to a low-tier blog and a generic Wikipedia page, and I could not verify it.
   citedeldorado.io/en/blog/blockchain-bandit-cr…ecurity-threats/en.wikipedia.org/wiki/Lazarus_Group

The cited evidence supports the claim as written.

1. #5[confirmed][no action needed]in section: 2023 Fund Movement

   “the actor moved nearly all accumulated holdings—51,000 ETH and 470 BTC—worth approximately $90 million at prevailing prices, to new addresses.”

   reviewerThe 2023 amounts and dates (51,000 ETH and 470 BTC, ~$90M, Jan 16-21, 2023).Confirmed by the Chainalysis post.
   citedwww.chainalysis.com/blog/blockchain-bandit-2023/
2. #9[confirmed][no action needed]in section: December 2024 Consolidation

   “Approximately 51,000 ETH, valued at approximately $172 million, were moved from 10 separate wallets—which had been dormant for nearly two years since the January 2023 movement—into a single multisig wallet.”

   reviewerOn Dec 30, 2024, ZachXBT identified 51,000 ETH (~$172M) moved from 10 wallets into a multisig; wallets were dormant nearly two years.Fully consistent with CoinTelegraph.
   citedcointelegraph.com/news/blockchain-bandit…ears-of-dormancy
3. #10[confirmed][no action needed]in the summary

   “the actor re-emerged in January 2023 and again in December 2024, consolidating approximately 51,000 ETH (valued at roughly $172 million) into a single multisig wallet, as tracked by on-chain investigator ZachXBT.”

   reviewerSummary: re-emerged in January 2023 and December 2024, consolidating ~51,000 ETH (~$172M) as tracked by ZachXBT.The December 2024 portion is supported. The January 2023 move is supported by Chainalysis.
   citedcointelegraph.com/news/blockchain-bandit…ears-of-dormancy