A developer gets a convincing job offer. A wallet signer approves a familiar-looking transaction. An investigator follows the money through a string of addresses, only to find it moving again. These are recurring parts of the public record around Lazarus, the name that keeps appearing after some of crypto's biggest thefts.
The story reaches well beyond crypto. It includes an attack on a Hollywood studio, money stolen from a central bank, ransomware that disrupted hospitals, fake trading software, undercover conversations and years of attempts to turn blockchain evidence into frozen funds and criminal cases.
This guide covers the major documented episodes and the machinery around them. Historical figures refer to their original reporting periods. Current case status and guidance were checked on October 30, 2026, in UTC. Government allegations, official attributions and private investigators' assessments are identified where they appear.
What Lazarus Group actually means
Lazarus Group is a public name used for North Korean state-linked cyber operations. In its 2019 sanctions announcement, the U.S. Treasury linked Lazarus, Bluenoroff and Andariel to the Reconnaissance General Bureau, North Korea's main intelligence agency. It described the latter two as subgroups of Lazarus.
That does not give outsiders a complete staff directory. Security companies and governments group activity differently, using overlaps in malware, infrastructure, targets and operating patterns. An activity label can describe a set of attacks without identifying every person who carried them out.
The names APT38 and TraderTraitor need particular care. U.S. criminal cases have described units known to researchers as Lazarus and APT38 within an alleged conspiracy. The FBI uses TraderTraitor for the North Korean activity it attributed to the 2025 Bybit theft. Treating all those names as perfectly interchangeable can erase differences between investigations.
The label also covers more than theft. Espionage, destructive attacks and revenue generation appear across the historical record. U.S. officials say cybercrime helps the North Korean regime evade financial restrictions and fund weapons programs. That is the stated national-security assessment behind much of the enforcement effort.
Before the crypto heists: Sony, Bangladesh and WannaCry
The 2019 assessment placed Lazarus's creation as early as 2007. That is an attributed estimate, rather than a publicly documented founding ceremony. The major cases that made the name famous came later.
In November 2014, Sony Pictures Entertainment suffered a destructive intrusion. Prosecutors allege that the attackers stole confidential material, threatened people and damaged thousands of computers in retaliation for The Interview, the comedy depicting a fictional assassination of North Korea's leader. A film release had become the setting for an international cyberattack.
The financial turn was especially visible in February 2016. According to the 2018 U.S. criminal complaint, the conspiracy stole $81 million from Bangladesh Bank. The attackers compromised the bank's environment and sent fraudulently authenticated SWIFT messages directing transfers from its account at the Federal Reserve Bank of New York. SWIFT is a bank-messaging system; this was not a Bitcoin theft.
Then came WannaCry in May 2017. The ransomware outbreak spread internationally, locking up computer systems and disrupting organizations including Britain's National Health Service. The United States and several allied governments attributed it to North Korea. Ransom demands used Bitcoin, but victims' computers and files were the immediate target.
Together, those episodes established a pattern of different objectives using related capabilities: punish an adversary, disrupt systems, steal information or obtain money. A story that starts only with crypto misses why banks, media companies, defense businesses and software suppliers belong in the same history.
Why crypto became such a valuable target
Crypto businesses combine valuable assets with software, remote teams and transfers that can cross borders quickly. Access to a wallet's signing system can authorize movements worth far more than the cost of gaining that access. Turning the proceeds into usable money remains another job, often involving outside services and intermediaries.
The February 2021 indictment described an alleged conspiracy seeking to steal and extort more than $1.3 billion in money and cryptocurrency. That figure described the charged schemes, not a verified total of completed crypto thefts.
The allegations included malicious cryptocurrency applications deployed from 2018 through 2020. Programs presented as trading tools or wallets could give attackers access to a user's computer. The case also described Marine Chain, a blockchain-based investment project that prosecutors alleged was designed to raise money and help evade sanctions through supposed interests in shipping vessels.
The selected theft estimates in the chart come from different investigations and dates. They are not a complete loss ledger or a single group's audited earnings. The current Binance entry is separated as a private-firm attribution while that investigation continues.
Ronin: five keys were enough
The March 2022 Ronin bridge theft is one of the clearest examples of how control over approvals can become control over money. The bridge supported the network used by Axie Infinity, connecting activity in the game economy with assets on another blockchain.
An incident-response account from Chainalysis says the attackers obtained five of the nine validator private keys. That majority allowed them to authorize two withdrawals: 173,600 Ether and 25.5 million USDC. Treasury's subsequent notice valued the theft at almost $620 million and attributed it to Lazarus.
A bridge depends on its own approval and custody design. If enough of the required signers are compromised, the surrounding blockchain can accept a transaction that meets the bridge's rules. The security failure does not require breaking the underlying network's cryptography.
Having multiple signers therefore helps only if their independence is real. Separate people approving the same misleading request, or credentials exposed through a shared environment, can still produce enough valid approvals. The case makes the details of a company's signing setup much more important than a simple claim that it uses several keys.
The job interview, the fake app and the trusted supplier
A September 2024 warning described patient social engineering against people in crypto and decentralized finance. Attackers researched employees, tailored stories to their interests and offered employment or investment opportunities. Conversations could continue long enough to feel ordinary before the request to install something or run a test arrived.
The familiarity is part of the risk. A polished website, fluent English and detailed knowledge of a person's work can make a false approach persuasive. A request to run an unfamiliar development project or install a special meeting application can arrive inside a conversation that otherwise looks professional.
The 3CX incident shows a different route through trusted software. In an April 11, 2023 update, the communications company reported Mandiant's assessment that the intrusion and supply-chain attack involved a cluster called UNC4736, with a high-confidence North Korean nexus. Its investigation described malware in both Windows and macOS environments.
That assessment should retain its own name and scope. A North Korean link does not automatically establish which Lazarus-labeled team was involved. For users, the broader lesson is that reaching a genuine supplier can still expose them to compromised software distributed through that supplier.
North Korean IT workers create a related hiring risk
A separate revenue-generating problem involves North Korean workers obtaining remote technology jobs under false identities. These schemes should not be flattened into a claim that every suspicious contractor belongs to one hacking crew.
A January 2025 advisory described workers stealing sensitive company information and, in some cases, extorting employers after discovery. It also warned about the use of artificial intelligence and face-swapping in interviews. A video call can help verify a person, but the existence of a call alone cannot settle identity.
Salary income and access abuse are different sources of harm. A company may unknowingly pay a worker serving the regime, expose internal repositories and credentials, or face demands involving stolen code. Contractors hired through another business can introduce the same problem farther from the customer's own hiring checks.
The response needs identity verification throughout employment, limits on access and attention to unusual account activity. Suspicions should be investigated through evidence and established security procedures, rather than assumptions based on someone's nationality, appearance or accent.
How stolen crypto becomes harder to follow
A theft can finish quickly while laundering continues across many transactions. Funds may pass through intermediary wallets, swaps, bridges and services that exchange crypto for conventional money. Investigators try to follow those movements before the proceeds reach a place where identifying information or access becomes harder to obtain.
The Ronin response described funds moving through more than 12,000 addresses by September 2022. The same account outlined conversions between Ether and Bitcoin and movements across networks. That address count was a dated observation about one investigation, not the number of identified hackers.
The Harmony Horizon case provides another example. Its January 2023 public update described more than $60 million in stolen Ether moving through the RAILGUN privacy protocol, with some proceeds later sent to service providers and converted into Bitcoin. Part of the funds was frozen with providers' cooperation.
Services have legitimate users as well as potential criminal customers. A bridge, privacy tool or exchange appearing in a laundering route does not establish that every user is a criminal. Nor does changing networks automatically destroy the trail. It changes the records and tools investigators must work with.
How investigators decide who is behind an attack
A blockchain address is an observable starting point. Investigators can examine transfers, amounts, timing and interactions with services. They can compare those patterns with previous incidents and ask whether the same infrastructure or money-handling network appears again.
Offchain evidence can make that picture much stronger: malware analysis, account records, seized devices, communications, employment information or details obtained through legal requests. A criminal case generally requires more than an address cluster and a plausible story about its owner.
Public attribution is therefore worth reading closely. An official statement may identify a country's activity; a company may report a likely intrusion route; an independent researcher may connect two laundering clusters. Those can support one another while answering different questions.
The September 2023 Stake.com announcement attributed about $41 million in theft to DPRK actors. Atomic Wallet customers had also suffered an approximately $100 million theft that June, according to a later sanctions notice. Earlier, the Horizon theft had been attributed to the same broader threat environment. These are specific assessments, not a license to attach the Lazarus name to every unsolved crypto loss.
ZachXBT's undercover case: following the people moving the money
One of the more unusual public investigations emerged in October 2026. In a detailed thread, ZachXBT said he had posed as a client of a Chinese laundering network handling proceeds linked to Lazarus. He described a network that had moved more than $1 billion across several exploits. Those are his investigative findings, rather than a criminal conviction of the people he discussed.
His account begins after the February 2025 Bybit theft. He noticed accounts asking for help with orders connected to stolen funds in public Telegram and Discord groups. He contacted several and began communicating with someone using the alias Jimmy Green.
On March 6, 2025, he says he funded a new address with 349,700 USDC to carry out transactions with that contact. Repeated dealings built trust, after which the contact began discussing future movements of Bybit proceeds and parts of the operation in Hong Kong and mainland China.
The useful evidence was where conversation and transactions met. He said a March 12 screenshot could be matched to a bridging order by its amount and timing. Three supplied Solana addresses then exposed a cluster of more than $12 million in Bybit proceeds being swapped across networks. He reported that 442,000 USDT linked to that cluster was later frozen by Tether.
The researcher says the operation cost him 5% on each order and carried a risk that the contact would disappear with his money. That is not the same as losing all the money he put up, and the total cannot be calculated without knowing every order and how funds were reused.
He also described ordinary small talk alongside the alleged laundering discussions: food, family, games and vacations. That detail matters because the people moving stolen funds can communicate like ordinary customers in ordinary support channels. The trail is in their transactions and relationships, not a cinematic hacker costume.
In the final post, he said he had helped bring about more than $75 million in DPRK-related freezes since 2022 and had promptly shared findings with trusted investigators and law enforcement. The publication was delayed because of the sensitivity of the investigation. His account does not announce Jimmy Green's arrest or establish the alias holder's real identity.
Recovering money has several different meanings
The most visible success may be a frozen balance, but freezing, seizure, return and compensation are different outcomes. A token issuer may restrict transfers under a token's rules. A service may hold funds in an account. A court-authorized seizure brings legal authority into the process. Returning property to victims can require further steps.
In September 2022, Erin Plante described more than $30 million in Ronin-related crypto seized with help from law enforcement and industry partners. The account credited tracing to cash-out points and coordination with services. It was a significant recovery announcement, but not a claim that the whole theft had been undone.
Native Bitcoin does not have a stablecoin issuer able to freeze balances. Some other systems have their own emergency powers. In the current Binance case, Arbitrum's Security Council says it moved 74,559,805 ARB and 8,425 ETH into an intermediary frozen wallet. Further movement requires council action or a governance vote. That differs from saying the assets have already been repaid to customers.
A separate post from ZachXBT thanked other signers involved in the Arbitrum action. It illustrates how an independent investigator can contribute to a coordinated response. It does not turn that action into a physical capture of the attackers.
Who has actually been named, charged or pursued?
The public U.S. criminal cases provide names that onchain pseudonyms alone cannot supply. Park Jin Hyok was charged in a complaint unsealed in September 2018. The expanded case announced in February 2021 also named Jon Chang Hyok and Kim Il, alleging that the three belonged to RGB units involved in an international conspiracy.
As of this guide's verification date, all three still have FBI wanted pages. Those pages describe alleged roles and arrest warrants; they do not establish convictions. The public record therefore supports saying they are wanted, rather than claiming the core suspects have been caught.
The surrounding money network has been a separate enforcement target. In March 2020, Tian Yinyin and Li Jiadong were charged with laundering more than $100 million associated with North Korean thefts. A forfeiture complaint identified 113 accounts and addresses. Those allegations describe the support network, not proof that the defendants personally carried out every underlying hack.
There have been actual convictions in the surrounding network. In September 2021, Ghaleb Alaumary was sentenced to 140 months in federal prison after pleading guilty to two money-laundering conspiracy counts. His cases included proceeds from a North Korean-perpetrated 2019 heist of a Maltese bank, alongside other fraud schemes. The court also ordered more than $30 million in restitution.
The earlier case alleged that Alaumary conspired with Ramon Abbas, known as Hushpuppi, to launder proceeds from the Maltese bank theft. That alleged connection concerns money handling; it does not establish that Abbas was one of the North Korean programmers. Separately, the February 2021 announcement reported approximately $1.9 million in crypto seizures from an affected New York financial-services company.
Sanctions add another kind of pressure. Blender.io was designated in May 2022; Sinbad.io in November 2023. These were U.S. actions against services officials said helped move illicit proceeds. Tornado Cash's history also shows why old legal descriptions need checking: economic sanctions against it were removed in March 2025. A historical designation should not be repeated as an automatically current rule.
Why the people are harder to catch than their transfers
An investigator may identify a suspicious cluster long before they can identify the person controlling it. Even a named suspect can remain outside a country's practical reach. Evidence gathering, a criminal charge, an arrest and a conviction are separate milestones, often involving different jurisdictions and legal powers.
The current wanted notices list the three North Korean suspects as last known to be in North Korea. Earlier prosecution documents allege that some operators also worked abroad, including in China and Russia. That helps explain why the investigation can focus on facilitators, financial services and recoverable funds when the alleged core operators remain beyond easy arrest.
Private researchers can publish evidence and alert partners. Providers, token issuers and network governance bodies can act within their own capabilities. Police and prosecutors can seek legal orders and pursue criminal cases. None of those roles supplies every power needed to finish the job alone.
Investigations into unrelated crypto crimes should also stay separate. ZachXBT has reported helping cases that led to arrests, but that does not establish an arrest of a Lazarus operator. A successful case against one thief cannot be borrowed as the ending to another story.
Bybit, Binance and the latest chapter
The February 26, 2025 public attribution identified North Korea as responsible for approximately $1.5 billion stolen from Bybit on February 21 and used the TraderTraitor label. It said proceeds were being converted into Bitcoin and other assets across thousands of addresses. The scale made the theft a major new reference point for exchange security.
The October 2026 Binance investigation adds another developing case. As previously reported by Apex in the related live, the exchange estimates roughly $6.3 billion in impact and says it is covering the shortfall with company resources. TRM's separate analysis values identified transfers at approximately $6.36 billion and attributes the activity to TraderTraitor using onchain and offchain intelligence. That remains a private firm's assessment rather than a public government attribution of this incident.
The distinction matters for the historical record. Early estimates can change; recovered balances can be confused with amounts merely frozen; a plausible first explanation can expand as more breach points emerge. The next revision of this story should follow evidence rather than treat an investigation's first hours as its final report.
What readers and crypto companies can do with this history
The recurring weakness is often a trusted relationship or an approval path around valuable assets. A hiring conversation, software supplier, employee account or signing interface can become the route in. Security needs to address those connections as well as the wallet holding the money.
For individuals, verify unexpected approaches through a separate established channel. Keep wallet recovery secrets out of chats and cloud notes. Treat requests to run unfamiliar software on a device with financial access as a reason to stop and check. A recognizable brand or a person on a video call does not remove the need for verification.
Companies need controls that remain useful when one employee or supplier is compromised: limited access, genuinely separate approvals, careful software distribution, monitoring and rehearsed incident response. Identity checks belong throughout a remote worker's employment, not only at the first interview. Those controls reduce exposure; no one product or audit eliminates it.
After a suspected incident, preserve evidence and contact the relevant provider, security team and local authorities. A payment to a stranger promising guaranteed recovery can create another loss. The practical aim is to shorten the time between a suspicious request, its detection and an informed response, before an attacker gets the approvals that let money move.