← Lazarus Group / TraderTraitor — DPRK September 2026 Blitz Campaignreviewed 2026-10-27 · 12 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Lazarus Group / TraderTraitor — DPRK September 2026 Blitz Campaign against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
2 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #11[unverifiable][awaiting moderator]in section: ZachXBT Declines to Monitor Bitget Incident
“On September 25, 2026, independent on-chain investigator ZachXBT posted publicly”
reviewerZachXBT posted on Sept 25 that he would not monitor the Bitget exploitThe only source was blocked. This says nothing about the claim. The sentence that mentions Mandiant and SlowMist investigations was also not checked. - #12[unverifiable][awaiting moderator]in section: TraderTraitor: Background and Official Government Attribution
“In December 2024, the FBI, Japan's National Police Agency, and DC3 issued a joint attribution formally identifying TraderTraitor as responsible for the $308M theft from DMM Bitcoin.”
reviewerTraderTraitor background: AA22-108A, FBI/NPA/DC3 DMM attribution, Bybit attributionNot fetched. The cited FBI and CISA URLs were not checked in this review. These are well known public events from outside the review window. Timeline dates are rounded to the first of the month (2024-12-01, 2025-02-01), so exact dates are unverified.
stale
2 claimsThe claim was accurate when written but events since have overtaken it.
- #1[stale][awaiting moderator]in the summary
“The largest confirmed incident is the September 24, 2026 Bitget exchange breach ($351.6M)”
reviewerBitget total loss was $351.6M (stated as the final/confirmed figure in the summary)$351.6M was the initial figure; Decrypt reports a later Bitget update to $387.5M and search results from other outlets agree. The page presents $351.6M without the revision.Proposed correction (not yet applied)The largest confirmed incident is the September 24, 2026 Bitget exchange breach ($351.6M initially reported, later revised by Bitget to $387.5M) - #2[stale][awaiting moderator]in section: Bitget Exchange Hack — September 24, 2026 ($351.6M)
“CEO Gracy Chen confirmed a total loss of $351.6 million in a public statement posted at 21:30 UTC.”
reviewerCEO confirmed a total loss of $351.6MThe initial figure was accurate when stated, but later reporting supersedes it. The 21:30 UTC timing was not independently checked.Proposed correction (not yet applied)CEO Gracy Chen confirmed an initial total loss of $351.6 million in a public statement posted at 21:30 UTC; Bitget later revised the figure to $387.5 million.
link rot
1 claimA cited source no longer resolves or no longer says what the page attributes to it.
- #7[link rot][awaiting moderator]in section: AFX Exchange Hack — July 22, 2026 ($24.15M) — Prior Connected Incident
“https://cryptonews.net/news/security/33229099/”
reviewerCited CryptoNews URL supports AFX detailsThe same dead URL also appears in sections[0].sources[2], timeline[6].source_url, timeline[7].source_url and sources_used. A Wayback copy is listed in sources_used but was not checked.Proposed correction (not yet applied)https://en.cryptonomist.ch/2026/07/31/afx-bridge-exploit-recovery/
partially supported
3 claimsThe cited evidence supports part of the claim but not all of it.
- #5[partially supported][awaiting moderator]in section: On-Chain Attribution: Specter Analysis and AFX-Bitget Link
“tracing stolen XRP from the Bitget breach through cross-chain bridging to an Ethereum address that had received 68,808 USDT from a wallet previously labeled the 'AFX EXPLOITER' address”
reviewerSpecter traced stolen Bitget XRP to an Ethereum address that received 68,808 USDT from the AFX exploiterThe core Specter linkage and quote are confirmed. The 68,808 USDT detail does not appear in the primary cited source. The page already labels the chain as alleged. - #6[partially supported][awaiting moderator]in section: AFX Exchange Hack — July 22, 2026 ($24.15M) — Prior Connected Incident
“AFX's post-mortem attributed the attack to UNC4899, also tracked as TraderTraitor, a DPRK-backed threat actor tracked by Mandiant, Microsoft Threat Intelligence, the FBI, and CISA.”
reviewerAFX hack on July 22, 2026 at 21:27 UTC, $24.15M USDC, attributed to UNC4899/TraderTraitor, July 9 Oddium Lab social engineering, ~12,467 ETH, goodwill plan Aug 3Facts are confirmed. The page's 'formally attributed' (also used in the same section and the summary) is stronger than AFX's 'consistent with external attribution' wording. - #8[partially supported][awaiting moderator]in section: September 2026 Supply Chain Operations: PolinRider and GHAPPIER
“On September 7, 2026, approximately 4,000 BTC (roughly $320M) were withdrawn from the Liquid Network sidechain developed by Blockstream”
reviewerLiquid Network exploit: ~4,000 BTC (~$320M, ~95% of pegged BTC) withdrawn on Sept 7 via SideSwap; self-identified whitehatsSome outlets date the withdrawal to Sept 6, so the Sept 7 date is the announcement or report date. The cause and return details come from later reporting, not this source.
confirmed
4 claimsThe cited evidence supports the claim as written.
- #3[confirmed][no action needed]in section: Bitget Exchange Hack — September 24, 2026 ($351.6M)
“At 18:31 UTC on September 24, 2026, Bitget detected unauthorized transfers from its hot and warm wallet infrastructure.”
reviewerBitget detected unauthorized transfers at 18:31 UTC on September 24Time confirmed by an independent outlet. The hot/warm wallet detail was not separately checked. - #4[confirmed][no action needed]in section: Bitget Exchange Hack — September 24, 2026 ($351.6M)
“Chen stated investigators found 'IP addresses matching virtual private network patterns used by a group from the Democratic People's Republic of Korea'”
reviewerBitget CEO said North Korea 'very likely' responsible based on IP/VPN patterns, and described the attribution as preliminarySubstance matches. The exact quoted wording was not verified because CNBC returned 403. - #9[confirmed][no action needed]in section: September 2026 Supply Chain Operations: PolinRider and GHAPPIER
“the actors reportedly returned approximately 85% of the withdrawn BTC”
reviewerApproximately 85% of the withdrawn BTC was returnedSupported by later reporting such as TRM Labs, via search results only. The cited Register article predates the return, so the citation does not back this sentence. - #10[confirmed][no action needed]in the summary
“Elliptic assessed the Bitget theft as highly likely DPRK-linked, pushing North Korea's documented 2026 crypto theft total above $1 billion.”
reviewerElliptic assessed Bitget as highly likely DPRK-linked, pushing 2026 DPRK theft above $1BConfirmed by search results from Elliptic's own post and others. Elliptic reportedly counts about $1.2B across 50+ incidents, which is higher than the page's figures.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.