Skip to main content
AVOID.NET

DPRK

avoid.net/dprk0/100·100% conf.

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·2awu5i…896M

Summary

The Democratic People's Republic of Korea (DPRK), operating primarily through state-sponsored hacking units designated as the Lazarus Group, TraderTraitor, and APT38, has stolen an estimated $6.75 billion in cryptocurrency since 2016 across dozens of major exploits. These operations are attributed by the FBI, OFAC, CISA, and allied governments to North Korea's Reconnaissance General Bureau and are conducted to fund the regime's weapons of mass destruction and ballistic missile programs in circumvention of international sanctions. DPRK-linked hackers are responsible for the largest single crypto theft in history — the $1.5 billion Bybit hack in February 2025 — and continue to operate at unprecedented scale and sophistication.

Connected Entities

19 entities · 60 linked investigations
Organizations
TraderTraitor / UNC48990Ronin Bridge52AlphaPo10Bybit72RailgunSafe{Wallet}68EthereumDriftTHORChainRonin NetworkWazirXHarmony Horizon BridgeDPRKZachXBT
Protocols
Axie InfinityDrift Protocol
Tokens
DMM BitcoinBitcoinCoinEx
Relationships
  • Ronin Bridgementioned withEthereum(80%)
  • Ethereummentioned withBitcoin(60%)
  • TraderTraitor / UNC4899mentioned withTHORChain(70%)
  • TraderTraitor / UNC4899mentioned withSafe{Wallet}(70%)
  • ZachXBTmentioned withEthereum(70%)
  • TraderTraitor / UNC4899mentioned withBybit(70%)
  • TraderTraitor / UNC4899mentioned withDrift(85%)
  • TraderTraitor / UNC4899mentioned withBitcoin(70%)
  • ZachXBTmentioned withBitcoin(65%)
  • TraderTraitor / UNC4899mentioned withEthereum(80%)
  • + 77 more
Have evidence about DPRK?

Timeline(18 events)

2018

Lazarus Group designated on OFAC Specially Designated Nationals List under North Korea Sanctions Regulations

23 March 2022

Ronin Network (Axie Infinity) bridge hacked; 173,600 ETH and 25.5M USDC stolen (~$625M). Attack later attributed to Lazarus Group by U.S. Treasury

14 April 2022

U.S. Treasury (OFAC) sanctions Lazarus Group Ethereum wallet linked to Ronin Bridge hack; FBI and OFAC jointly attribute attack to DPRK

22 April 2022

CISA, FBI, and U.S. Treasury issue joint advisory AA22-108A on TraderTraitor, warning blockchain companies of DPRK targeting

6 May 2022

OFAC issues first-ever sanctions on a virtual currency mixer — Blender.io — for processing over $20.5M in Ronin hack proceeds

24 June 2022

Harmony Horizon Bridge hacked; $100M in crypto assets stolen. FBI later confirms Lazarus Group responsible

13 January 2023

North Korean actors use RAILGUN protocol to launder over $60M in ETH from Harmony Horizon Bridge hack; funds also routed through Tornado Cash

June 2023

Atomic Wallet breached; over $100M stolen from users. Blockchain analytics firms attribute attack to Lazarus Group

November 2023

OFAC sanctions Sinbad.io virtual currency mixer for laundering Lazarus Group funds from Ronin Bridge and Horizon Bridge heists

31 May 2024

DMM Bitcoin (Japan) loses $308M in Bitcoin via supply-chain attack traced to TraderTraitor operative posing as recruiter to compromise Ginco developer. FBI and Japan NPA jointly attribute the attack

18 July 2024

WazirX (India) loses $234.9M; Lazarus Group manipulates multisig smart contract during signing session. ZachXBT traces test transactions to July 10 and notes Tornado Cash funding of attacker addresses

14 January 2025

United States, Japan, and South Korea issue first-ever trilateral joint statement on DPRK cryptocurrency theft, citing over $659M stolen in 2024

21 February 2025

Bybit exchange hacked; ~499,000 ETH (~$1.5B) stolen via Safe wallet supply-chain attack. TraderTraitor actors inject malicious code targeting Bybit-specific transactions

26 February 2025

FBI issues IC3 PSA250226 attributing Bybit hack to North Korean TraderTraitor; releases 51 Ethereum addresses used in laundering. ZachXBT independently identifies Lazarus Group via wallet linkage and receives $50K Arkham bounty

5 March 2025

Lazarus Group alleged to have laundered 83% of stolen Bybit ETH (~$1B) through THORChain, converting to Bitcoin distributed across 6,954 wallets; THORChain earns ~$5.5M in fees. Several THORChain developers resign after community votes against blocking laundering

December 2025

North Korea-linked hackers confirmed to have stolen over $2.02 billion in 2025 — a 51% year-over-year increase — representing the worst annual total on record

12 March 2026

OFAC sanctions six individuals and two entities for DPRK IT worker fraud schemes; designates 21 cryptocurrency addresses across multiple blockchains

April 2026

Drift Protocol compromised in elaborate social engineering operation; North Korean proxies met Drift employees in person at conferences and made deposits over $1M to appear as legitimate partners before exploiting the protocol for $285M

Provenance & Audit Trail

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (1 event).

model: claude-sonnet

generated: 5/4/2026, 4:04:57 PM

last updated: 8/29/2026, 1:35:00 AM

4 views

avoid.net — verified advice for a post-truth world