Who Is the Lazarus Group? North Korea's Crypto Hackers

Why Everyone Is Asking About the Lazarus Group Right Now

On October 29, 2026, attackers drained roughly $6.3 billion from Binance. Most of it moved in about 20 minutes. Blockchain investigators quickly pointed to the Lazarus Group.

That link isn't confirmed. Binance and government agencies haven't named a culprit.

So who is behind the name? The Lazarus Group is North Korea's state-backed hacking network, and the US has sanctioned it since 2019. If you're new to crypto, here's the short version. The biggest thefts on record now look more like a government program than random crime. This guide covers what the Lazarus Group is, what it has stolen, how it gets in, and why freezes may hurt it most.

What Is the Lazarus Group? A One-Paragraph Answer

The Lazarus Group isn't one gang in one office. It's a name for North Korean hacking units that answer to the state. In 2019, the US Treasury designated the Lazarus Group and two sub-groups, Bluenoroff and Andariel. It said the network is controlled by the Reconnaissance General Bureau, North Korea's main intelligence agency.

Names get messy. Researchers also use labels like APT38 and TraderTraitor. TraderTraitor is the cluster most often tied to exchange and wallet thefts. In headlines, "Lazarus" usually means North Korean state hackers in general.

Why steal crypto? Sanctions shut North Korea out of much of the global banking system. US officials say the proceeds help fund weapons programs. Pyongyang has denied involvement in these thefts.

"State-sponsored" means a government directs, funds or protects the operation. That matters. A state team has patience, salaries and no fear of local police.

That gap separates the Lazarus Group from ordinary cybercriminals. A normal crew wants a quick payout before someone arrests them. A government unit can plan for months, rehearse an attack and wait for the right moment. It also has little reason to fear extradition. Think of it as a long-term business with one customer: the state.

How Much Crypto Has North Korea Stolen? A Decade of Heists

Blockchain analytics put the lower-bound total near $6.75 billion by the end of 2025. That year alone, North Korean actors took at least $2.02 billion. It was roughly 59% of the $3.4 billion stolen across the whole industry. In 2024, the figure was about $1.3 billion.

One hack drove 2025. In February 2025, attackers took about $1.5 billion in Ether from Bybit. The FBI said TraderTraitor was responsible.

Here are the headline cases.

Look at the pattern. Attacks by the Lazarus Group are getting fewer but bigger. Analytics data shows 2025 had fewer incidents than earlier years, yet it set a record for value stolen. The Binance case would stretch that further. Early estimates put it at roughly four times the size of Bybit.

Earlier in 2026, investigators also tied exploits at Kelp DAO and Drift Protocol to North Korea-linked actors.

One caution. Every total here is an estimate. Firms attribute thefts differently, and attribution can change. Treat the numbers as a range, not a ledger.

Why does this matter to everyday readers? Large exchange thefts hit prices, freeze withdrawals and shake trust. When Binance suspended deposits and withdrawals after the attack, traders felt it immediately. Even when a company covers customer losses, the scare spreads across the market. That ripple effect is part of the cost of every big Lazarus Group heist.

How Does the Lazarus Group Get In? The Playbook

The Lazarus Group rarely cracks the code itself. It goes after people. A stolen login is cheaper than breaking cryptography.

Social engineering: the long con

Social engineering means tricking someone into handing over access. Common lures include fake recruiters, fake investors and "coding tests" that carry malware. Attackers can chat for weeks. Then one file gets opened.

Device and tool compromise

The Bybit attack shows how this works. Attackers compromised a developer's machine at a wallet-software provider. Then they altered what signers saw, so staff approved a malicious transfer. In the Binance case, the company says early findings point to a compromised engineer's laptop. The full picture isn't public yet.

IT worker infiltration

This route is slower. Treasury says North Korea places IT workers inside real companies using fake or stolen identities. On October 28, 2026, OFAC sanctioned 10 individuals and one entity tied to these schemes. Treasury says the regime keeps most of the wages, worth hundreds of millions of dollars. It also warns that some workers used company access to deploy malware and steal data.

Analyst view: wages are the small prize. Access is the big one. A worker inside a crypto firm sits much closer to keys and signing systems than any outsider.

Put together, the three routes feed each other. A phishing message opens one door. A fake hire opens another. A compromised developer tool opens a third. The Lazarus Group only needs one of them to work.

Read the full Treasury release for the named facilitators.

Where Does the Stolen Money Go? Laundering Routes

Stealing is half the job. Cashing out is harder, because stolen coins get frozen. So the Lazarus Group moves fast.

Analysts describe a cycle that runs about 45 days. This table simplifies it.

A 45-day cycle sounds slow, but it works in the attacker's favor. Early days are chaotic. Exchanges and issuers are still working out what happened, and wallet lists are incomplete. The longer the trail, the more places an investigator must watch at once. That is also why quick freezes in the first hours matter so much.

Mixers have been an enforcement target. In May 2022, Treasury sanctioned the mixer Blender, its first move against a mixing service. It said Blender handled $20.5 million from the Ronin theft.

Reports from the Binance case say the attacker began swapping through decentralized exchanges within hours. That fits the usual aim: turn freezable tokens into assets nobody can lock.

Can the Lazarus Group Be Stopped? Sanctions and Setbacks

Sanctions are the main government tool against the Lazarus Group. They've been used heavily.

• 2019: Treasury designates the Lazarus Group, Bluenoroff and Andariel.

• April 2022: Treasury adds the Ronin attacker's wallet address to its sanctions list.

• May 2022: Blender becomes the first mixer sanctioned.

• October 2026: OFAC hits IT worker networks, building on a March 2026 action. Australia and the EU also issued designations this month.

Setbacks are real, though. A record theft year in 2025 came after years of sanctions. And enforcement against mixers isn't settled. Treasury lifted its Tornado Cash designation in March 2025 after court challenges.

The real teeth point at everyone else. OFAC can impose penalties on a strict liability basis, meaning intent isn't required. If agencies confirm the Binance attribution, any firm that handles the proceeds faces sanctions risk.

The Lazarus Group also faces a wider circle now. Treasury says it works with allies through a multilateral monitoring team, and other governments are issuing their own designations. Still, none of that has shut the operation down.

So can the Lazarus Group be stopped? Not fully. Making each theft less profitable is the realistic goal.

Why Exchanges Remain the Top Target for Lazarus

Exchanges check several boxes for the Lazarus Group at once:

• Big pools of money. Exchanges keep funds in hot wallets, which are wallets connected to the internet, so withdrawals can run. One breach can reach billions.

• Few doors, huge payoff. One successful hit beats dozens of small ones.

• Speed. In the Binance case, investigators traced funds leaving across ten blockchains within minutes.

• People with power. Staff touch signing systems, and staff can be tricked.

Analyst view: a smart contract bug needs a skilled coder to find. An exchange breach can start with a convincing message to the right employee. That's a much cheaper way in for a patient state team.

Hot versus cold storage explains the rest. Cold storage keeps keys offline, so it is harder to reach but slower to use. Hot wallets stay online for daily withdrawals. Every exchange needs some hot balance to function. The question is how much, and how well each signing step is checked. Attackers like the Lazarus Group study that trade-off closely.

Conclusion: Why Freezes Change the Lazarus Group's Math

The industry has learned a hard lesson. Strong code isn't enough. The weak points are laptops, signing steps and new hires. Security teams now stress limited hot wallet balances, checks on what signers actually approve, and tighter vetting of staff.

Here is what the industry now treats as basic practice:

• Limit hot wallet balances and set withdrawal caps.

• Verify what a signer actually approves, not just what a screen shows.

• Lock down engineer laptops and developer tools.

• Screen hires and contractors for identity fraud.

• Keep direct lines open to stablecoin issuers and other exchanges.

Freezes add a second layer. Stablecoin issuers can lock tokens. Binance says about $3 billion of the roughly $6.3 billion was frozen with partner help, mostly stablecoins. If that holds, nearly half the haul became hard to cash.

That changes the economics for the Lazarus Group. Native coins can't be frozen the same way, so attackers must convert quickly. Every swap is a chance to catch them. A theft that pays 50 cents on the dollar isn't the same business as one that pays a full dollar.

What remains uncertain? The Binance attribution isn't confirmed by the company or by agencies. Final recovery figures aren't known. Reports also say large unfrozen coin balances remain with the attacker. Check Treasury and OFAC pages, FBI statements and exchange updates for what comes next. Data reflects public reporting as of October 31, 2026.

Disclaimer: This article is for information only and is not financial, legal or investment advice. Crypto assets are volatile and high-risk, and attributions of hacks may change as investigations continue. Always do your own research before making any decision.