Lazarus Group

Treasury’s 2019 announcement traces the group’s creation by North Korea to as early as 2007. MITRE describes activity since at least 2009. These are retrospective assessments of covert operations, rather than a documented public incorporation date.⁠[1][2]

Sony Pictures confirmed in late November that an attack had damaged systems and stolen personal and commercial data. On December 19, the FBI attributed it to North Korea, citing malware and infrastructure links. Later U.S. charges against alleged Lazarus-linked operatives included this incident.⁠[3][4]

A U.S. criminal complaint announced in 2018 attributed the 2016 theft of $81 million from Bangladesh Bank to the alleged conspiracy. Treasury subsequently described fraudulent transfer requests using stolen SWIFT credentials, distinguishing funds stolen from transfers that were attempted but stopped.⁠[5][1]

The 2021 U.S. indictment announcement included alleged creation of WannaCry 2.0 in May 2017. Treasury noted that several governments publicly attributed the attack to North Korea in December 2017 and described disruption to institutions including Britain’s National Health Service. The attack and the later public attribution occurred at different times.⁠[4][1]

The Justice Department unsealed a criminal complaint accusing Park Jin Hyok of participating in a North Korean-backed hacking conspiracy and working for government-linked Chosun Expo. The announcement connected the Sony, Bangladesh Bank and WannaCry cases. Unsealing allegations did not establish a conviction.⁠[5]

OFAC sanctioned Lazarus Group, Bluenoroff and Andariel, describing the latter two as Lazarus subgroups in that announcement. It emphasized Bluenoroff’s financial theft and Andariel’s government, corporate and defense targets. The action blocked covered property in the United States or controlled by U.S. persons.⁠[1]

Treasury sanctioned Tian Yinyin and Li Jiadong for allegedly helping launder exchange assets linked to Lazarus. It said they received about $91 million from one 2018 attack and $9.5 million from another exchange hack. Those amounts differed from the approximately $250 million stolen in the first attack as a whole.⁠[6]

U.S. prosecutors unsealed an indictment against Jon Chang Hyok, Kim Il and Park Jin Hyok, alleging RGB-unit membership and a conspiracy involving destructive attacks, bank theft and malicious cryptocurrency applications. It was filed on December 8, 2020 and unsealed on February 17, 2021. The announcement stated that the allegations remained to be proved.⁠[4]

The FBI said its investigation attributed an Ethereum theft, reported on March 29 and valued at $620 million, to DPRK-associated Lazarus Group and APT38 actors. The statement identified the reporting date and contemporary dollar valuation, rather than an amount recovered.⁠[7]

A joint FBI, CISA and Treasury advisory described social engineering against blockchain and cryptocurrency businesses. It outlined recruitment lures and supposed trading tools that delivered malware, enabling private-key theft or fraudulent transactions. In that advisory, TraderTraitor described a series of malicious applications.⁠[8]

The FBI attributed the $100 million Harmony Horizon bridge theft reported on June 24, 2022 to Lazarus, also using the APT38 name in its statement. It said more than $60 million in related ether passed through a privacy protocol in January 2023 and some funds were frozen with service-provider cooperation. It did not report full recovery.⁠[9]

Arkham announced a tracking view for Lazarus-linked addresses covered in ZachXBTZachXBTZachXBT is a pseudonymous blockchain investigator who examines cryptocurrency scams, thefts and fund movements, and serves as an incident response advisor to Paradigm. His work involves public investigations, onchain analysis and collaboration with security researchers and law enforcement.Open the full entry’s investigation. It said it identified seven additional addresses holding 891.13 BTC, valued at about $63.23 million at the time. Address attribution and visible balances did not mean the assets had been seized or returned.⁠[10]

Arkham said ZachXBT submitted evidence linking the Bybit attack to Lazarus at 19:09 UTC, including test transactions, connected wallets, graphs and timing analysis. On February 26, the FBI attributed the approximately $1.5 billion February 21 Bybit theft to North Korea, calling the specific activity it tracked TraderTraitor.⁠[11][12]

ZachXBT said he posed as a client of a Chinese organized crime network allegedly laundering proceeds from multiple Lazarus attacks, putting its involvement above $1 billion. He said he fronted 349,700 USDC on March 6, 2025 and matched communications to blockchain transactions associated with Bybit funds. The network attribution and aggregate amount were his investigative claims.⁠[13]

He also reported identifying more than $12 million in related funds, of which 442,000 USDT was subsequently frozen by Tether, and promptly sharing intelligence with trusted private investigators and law enforcement. His separate claim of facilitating more than $75 million in DPRK-related freezes since 2022 described a broader cumulative total, not this operation alone.⁠[13]

The scope of Lazarus, APT38, Bluenoroff, Andariel, HIDDEN COBRA and TraderTraitor varies across sources. Treasury used subgroup classifications in 2019; MITRE explains HIDDEN COBRA as a U.S. government label for North Korean malicious cyber activity; and FBI case announcements use names appropriate to the activity being investigated.⁠[1][2][12]

MITRE ATT&CK: Research profile: https://attack.mitre.org/groups/G0032/ (opens in a new window).⁠[2]