Lazarus Hacker Group Starts Moving Bitcoin: Analyzing the Pattern

Suddenly, 262.2 BTC, or roughly $16.6 million at current prices, was transferred from a Bitcoin address identified as belonging to the North Korea-affiliated Lazarus Group. Although the structure of the transaction does not yet appear to be a simple liquidation of the group’s Bitcoin holdings, it still merits attention.

Restructuring their holdings

The transaction shows 262.20040151 BTC leaving bc1q62cl…ddkteq and being divided between two new addresses. Approximately 182.2 BTC went to bc1qwnah…ld5g2xy5, while exactly 80 BTC was transferred to bc1qxdkk…0874k9zs.

Since the provided transaction data does not show an exchange destination, the transfer itself cannot be interpreted as proof that Lazarus is selling $16.6 million worth of Bitcoin. Rather, the movement is similar to the first phases of fund redistribution: transferring holdings between new addresses before further transactions decide where they will ultimately end up. 

This behavior is in line with the more general issue that investigators encounter when tracking cryptocurrencies connected to Lazarus. According to court documents, Lazarus/APT38 and other North Korean hacking groups run networks of wallets that are used to transfer money obtained from cyberattacks. 

Could it be a simple washing?

According to research, Lazarus-linked Bitcoin addresses are not just wallets that instantly send money to exchanges, but rather parts of larger money laundering networks. However, there is little immediate significance for the price of Bitcoin. The current price of Bitcoin is around $63,800, so a movement of 262 BTC is equivalent to about $16.7 million. 

In comparison to the typical market liquidity of Bitcoin, even if the whole amount were eventually sold, that would still be quite little. There is also no clear response to the transfer on the price chart. With a short-term average of about $64,000 and a 50-day moving average of about $63,400, Bitcoin is still concentrated between $63,000 and $65,000. 

About $66,600 and $71,900 are still the higher resistance levels. As a result, this transaction is much less important than the ones that follow. The movement would appear more and more like a liquidation or money laundering sequence if the two receiving wallets started splitting the Bitcoin further, interacting with more intermediary addresses, or eventually depositing funds into exchanges.

Although the blockchain evidence does not yet indicate that Lazarus is selling its Bitcoin, it currently appears to be moving its Bitcoin.