Lazarus Group threat profile
Lazarus Group is North Korea's state-backed hacking operation, working under the Reconnaissance General Bureau. It has stolen over $6 billion from the crypto industry since 2017, including the $1.5 billion Bybit theft in February 2025. It mostly gets in through people and infrastructure, using fake job offers, trojanised apps and supply chain compromises, rather than smart contract bugs.
Who they are
Lazarus Group operates under North Korea’s Reconnaissance General Bureau (RGB). Unlike criminal groups chasing easy money, it serves state objectives: circumventing sanctions, funding weapons programmes and reaching financial systems that are otherwise closed to the country. That makes it patient and well resourced. It will spend months preparing a single operation.
HYDN’s team has over 40 years of combined experience countering advanced persistent threat groups, including Lazarus, Kasablanka and MuddyWater.
Major crypto thefts attributed to Lazarus
| Date | Target | Amount |
|---|---|---|
| March 2022 | Ronin Bridge (Axie Infinity) | About $614 million |
| June 2022 | Harmony Horizon Bridge | About $100 million |
| June 2023 | Atomic Wallet | Over $100 million |
| July 2023 | CoinsPaid | About $37.3 million |
| July 2023 | Alphapo | $60 million |
| September 2023 | Stake.com | About $41 million |
| September 2023 | CoinEx | $54 million (indicators consistent with Lazarus) |
| May 2024 | DMM Bitcoin | $308 million |
| February 2025 | Bybit | About $1.5 billion |
| April 2026 | Drift Protocol, KelpDAO | $286 million and $290 million |
How they attack
- Fake recruiters. The “Contagious Interview” campaign approaches developers and operations staff on LinkedIn and asks them to run a coding assessment that installs malware. See fake recruiter attacks.
- Trojanised apps. Fake trading and portfolio tools such as Celas Trade Pro (Operation AppleJeus) and the TraderTraitor applications.
- Supply chain compromise. The Bybit theft came through a compromised developer machine at its wallet provider, Safe{Wallet}. See supply chain attacks.
- Spear phishing and watering holes. Targeted emails, and compromised websites their targets visit.
- Custom malware. Remote access trojans such as QuiteRAT and MagicRAT, and the DeimosC2 framework.
- False flags. Misleading clues, such as Romanised Russian words in malware, to confuse attribution.
How they launder
Stolen funds are typically dispersed across thousands of wallets, run through DeFi protocols and mixers, moved across chains through bridges and no-KYC swap services, and converted to fiat over roughly 45 days. Some funds are left dormant to wait out the attention that follows a large theft.
How to defend against them
- Assume compromise, and design so that no single person, laptop or credential can move treasury funds.
- Verify high-value transactions out of band, and show signers exactly what they are signing.
- Ban running unknown code from recruiters or outside contacts on work machines.
- Use hardware security keys for authentication.
- Lock and review dependencies, and audit developer tooling.
- Test your detection and response with red team exercises built around these techniques.
Frequently asked questions
Who is Lazarus Group?
A North Korean state-sponsored hacking group operating under the Reconnaissance General Bureau, the country's primary intelligence agency. Its crypto thefts fund the regime and help it evade sanctions.
How much has Lazarus stolen?
North Korea-linked actors are estimated to have stolen over $6 billion in crypto since 2017. Chainalysis reported at least $2.02 billion stolen in 2025 alone, including the $1.5 billion Bybit theft.
How does Lazarus usually get in?
Through people. Fake recruiters, malicious 'technical assessments', trojanised trading apps, spear phishing and compromised suppliers are its main routes, followed by patient movement through internal systems toward wallets and signing infrastructure.
What is TraderTraitor?
The name the FBI uses for the Lazarus cluster it attributed the Bybit attack to, also tracked as Jade Sleet, Slow Pisces and UNC4899. The same cluster was linked to the $308 million DMM Bitcoin theft in May 2024.
Published Updated