North Korea-linked Lazarus Group transferred 244.148 Bitcoin worth about $19.42 million on Aug. 28. The movement drew fresh attention to labeled wallets tied to the sanctioned hacking operation during ongoing efforts to trace stolen cryptocurrency.
In an X post, Lookonchain highlighted that the wallets became active about an hour earlier. It did not identify the receiving address or say whether the funds reached an exchange, mixer, or another wallet. The transaction alone does not establish a sale or cash-out attempt.
Another large movement occurred earlier in August. On Aug. 12, an attributed wallet sent 262.2 BTC to a new address. The assets carried an estimated value of $16.64 million at that time.
Also Read: Solana Transaction Hits Record 4.2 Billion in July
The two August transactions involved more than $36 million at their reported values. However, no available source has confirmed that they came from the same balance or served a shared purpose.
Bybit Lawsuit Adds Pressure on Lazarus Group
Bybit filed a lawsuit against the federal government on August 7. The exchange sued North Korea, the Reconnaissance General Bureau, and the Lazarus Group to retrieve the assets associated with the $1.5 billion Bybit hack.
The RGB was listed as a defendant in the case filing. The U.S. Treasury Department refers to it as the primary intelligence agency of North Korea. A restraining order limits the disposition of the identified assets as the case progresses.
The FBI attributed the attack in February 2025 to actors belonging to North Korea, called TraderTraitor. They mentioned that the hackers managed to convert some stolen assets to Bitcoin and others.
The funds were distributed across thousands of addresses on various blockchain networks. In April 2025, Bybit CEO Ben Zhou mentioned that 27.6% of the stolen funds have disappeared.
Lazarus Group Linked Attacks Continued in 2026
According to Chainalysis, North Korean hackers stole at least $2.02 billion in cryptocurrencies in 2025. It was 51% higher than the losses in the previous year. The company set their total thefts of cryptocurrencies to no less than $6.75 billion.
Later, other activity took place in April 2026 when hackers siphoned off around 116,500 rsETH from the KelpDAO LayerZero bridge. According to the LayerZero report, the loss was approximately $292 million and was carried out by TraderTraitor.
As per Chainalysis, the criminals hacked the infrastructure used for feeding the data into the verification system of the bridge. The fake data indicated a nonexistent token burning. Later, the contract on Ethereum released the tokens to the address of the hacker.
Rapid intervention prevented other hacking worth $95 million. Also, the Arbitrum Security Council blocked 30,766 ETH involved in other transactions downstream.
The United States Treasury Department issued sanctions against Lazarus Group in September 2019 due to its connections with RGB. Covered property under U.S. control must be blocked and reported to OFAC. Federal rules also generally prohibit U.S. persons from dealing with designated entities.
Also Read: Arthur Hayes Flags AI Bubble Risks for Crypto Markets in 2026
Be the first to comment