[REVISION HISTORY]

Lazarus Group cryptocurrency theft and litigation

Updated 4 times since CLSTR started tracking revisions of this situation.

What changed

2026-08-10 15:52 UTC → 2026-08-28 22:32 UTC · added ~~removed~~

The North Korean-linked Lazarus Group continues to engage in large-scale cryptocurrency thefts and movements. In late July 2026, the group transferred approximately $7.7 million in Bitcoin, part of a long-term pattern of laundering stolen digital assets. In August 2026, the cryptocurrency exchange Bybit filed a civil RICO lawsuit in the U.S. District Court for the District of Columbia against North Korea, its Reconnaissance General Bureau, and the Lazarus Group. The suit seeks to recover approximately $1.5 billion stolen during a February 2025 cyberattack involving the theft of over 400,000 ETH and stETH. The attackers, identified by the FBI as North Korean actors known as “TraderTraitor” and linked to the Lazarus Group, reportedly compromised a developer's computer at Safe{Wallet} to inject malicious code and drain the wallet. Bybit CEO Ben Zhou stated that the exchange's priorities are “protecting users, recovering assets, and holding attackers accountable.” Following the lawsuit, a U.S. federal court issued a preliminary injunction and granted Bybit expedited discovery to aid in fund recovery. This legal order allows Bybit to request account identities, balances, and transaction histories from platforms with U.S. operations. While Bybit has recovered approximately $48.4 million and frozen an additional $30.5 million across more than 28 global exchanges, the company reports that roughly 90.2% of the stolen funds remain untraceable due to the use of mixers, cross-chain bridges, and decentralized swaps. ~~This incident coincides with broader trends; blockchain analytics firm Chainalysis estimated that North Korean-linked actors stole approximately $2.02 billion~~ Lazarus Group activity remains high; in ~~cryptocurrency during 2025, a 51% increase from~~ late August 2026, the ~~previous year. U.S. officials~~ group moved 244.148 Bitcoin valued at approximately $19.42 million, an action analysts suggest ~~these thefts, which total~~ marks an ~~estimated $6.75 billion to date, help finance the regime's weapons programs.~~ exit from “sleep mode” for those specific wallets. This follows another large movement in August involving 262.2 BTC valued at roughly $16.64 million.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.