DPRK
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·2awu5i…896MSummary
The Democratic People's Republic of Korea (DPRK), operating primarily through state-sponsored hacking units designated as the Lazarus Group, TraderTraitor, and APT38, has stolen an estimated $6.75 billion in cryptocurrency since 2016 across dozens of major exploits. These operations are attributed by the FBI, OFAC, CISA, and allied governments to North Korea's Reconnaissance General Bureau and are conducted to fund the regime's weapons of mass destruction and ballistic missile programs in circumvention of international sanctions. DPRK-linked hackers are responsible for the largest single crypto theft in history — the $1.5 billion Bybit hack in February 2025 — and continue to operate at unprecedented scale and sophistication.
Connected Entities
19 entities · 59 linked investigations- Ronin Bridge→mentioned with→Ethereum(80%)
- Ethereum→mentioned with→Bitcoin(60%)
- TraderTraitor / UNC4899→mentioned with→THORChain(70%)
- TraderTraitor / UNC4899→mentioned with→Safe{Wallet}(70%)
- ZachXBT→mentioned with→Ethereum(70%)
- TraderTraitor / UNC4899→mentioned with→Bybit(70%)
- TraderTraitor / UNC4899→mentioned with→Drift(85%)
- TraderTraitor / UNC4899→mentioned with→Bitcoin(70%)
- ZachXBT→mentioned with→Bitcoin(65%)
- TraderTraitor / UNC4899→mentioned with→Ethereum(80%)
- + 77 more
Connected Through
18 shared actors · 636 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Ethereumorganization
- □ZachXBTorganization
- ♦Bitcointoken
- □Driftorganization
Timeline(18 events)
2018
Lazarus Group designated on OFAC Specially Designated Nationals List under North Korea Sanctions Regulations
23 March 2022
Ronin Network (Axie Infinity) bridge hacked; 173,600 ETH and 25.5M USDC stolen (~$625M). Attack later attributed to Lazarus Group by U.S. Treasury
14 April 2022
U.S. Treasury (OFAC) sanctions Lazarus Group Ethereum wallet linked to Ronin Bridge hack; FBI and OFAC jointly attribute attack to DPRK
22 April 2022
CISA, FBI, and U.S. Treasury issue joint advisory AA22-108A on TraderTraitor, warning blockchain companies of DPRK targeting
6 May 2022
OFAC issues first-ever sanctions on a virtual currency mixer — Blender.io — for processing over $20.5M in Ronin hack proceeds
24 June 2022
Harmony Horizon Bridge hacked; $100M in crypto assets stolen. FBI later confirms Lazarus Group responsible
13 January 2023
North Korean actors use RAILGUN protocol to launder over $60M in ETH from Harmony Horizon Bridge hack; funds also routed through Tornado Cash
June 2023
Atomic Wallet breached; over $100M stolen from users. Blockchain analytics firms attribute attack to Lazarus Group
November 2023
OFAC sanctions Sinbad.io virtual currency mixer for laundering Lazarus Group funds from Ronin Bridge and Horizon Bridge heists
31 May 2024
DMM Bitcoin (Japan) loses $308M in Bitcoin via supply-chain attack traced to TraderTraitor operative posing as recruiter to compromise Ginco developer. FBI and Japan NPA jointly attribute the attack
18 July 2024
WazirX (India) loses $234.9M; Lazarus Group manipulates multisig smart contract during signing session. ZachXBT traces test transactions to July 10 and notes Tornado Cash funding of attacker addresses
14 January 2025
United States, Japan, and South Korea issue first-ever trilateral joint statement on DPRK cryptocurrency theft, citing over $659M stolen in 2024
21 February 2025
Bybit exchange hacked; ~499,000 ETH (~$1.5B) stolen via Safe wallet supply-chain attack. TraderTraitor actors inject malicious code targeting Bybit-specific transactions
26 February 2025
FBI issues IC3 PSA250226 attributing Bybit hack to North Korean TraderTraitor; releases 51 Ethereum addresses used in laundering. ZachXBT independently identifies Lazarus Group via wallet linkage and receives $50K Arkham bounty
5 March 2025
Lazarus Group alleged to have laundered 83% of stolen Bybit ETH (~$1B) through THORChain, converting to Bitcoin distributed across 6,954 wallets; THORChain earns ~$5.5M in fees. Several THORChain developers resign after community votes against blocking laundering
December 2025
North Korea-linked hackers confirmed to have stolen over $2.02 billion in 2025 — a 51% year-over-year increase — representing the worst annual total on record
Decision Log
- slot 420650919 · hash 4PNBAWpwdrBimL6uV148VR9DUSTsEPvJVuKHvUPnWR6D
This investigation is cryptographically anchored to the Solana blockchain (1 decision).
model: claude-sonnet
generated: 5/4/2026, 4:04:57 PM
last updated: 8/29/2026, 1:35:02 AM
5 viewsavoid.net — verified advice for a post-truth world