Most crypto thefts are committed by lone actors and small crews out for a quick score. But there is a player of a different scale — the state-sponsored hacking group of North Korea. For it, breaking into exchanges and bridges is not an adventure but a line in the budget: the stolen billions go toward the regime's programs. To understand how Lazarus operates is to understand where the industry's most "toxic" crypto comes from.
Lazarus Group is a state-sponsored hacking group of North Korea, and that changes everything. An ordinary thief fears getting caught, is limited in resources and acts chaotically. A state-sponsored group works differently: it has staff, time, patience and political cover. It is not trying to hide from its own country — on the contrary, it acts in that country's interests. According to investigators and sanctions bodies, the stolen funds go toward the regime's programs, which moves these thefts out of the criminal realm and into the realm of national security.
This is exactly why Lazarus is rightly called the industry's chief "supplier" of stolen crypto. When you run into an address in a check that is tagged as linked to this group, you are dealing not simply with dirty money but with funds under sanctions and geopolitical scrutiny. Getting it wrong here is especially costly.
The group is credited with billions of dollars stolen from crypto venues and infrastructure. Let's go through the confirmed cases from our dossier.
Note the pattern in the choice of targets. Ronin and Harmony are bridges and sidechains, the nodes through which assets move between blockchains. Bybit is a large exchange. Atomic Wallet is a wallet. All of these are points where other people's funds concentrate: where the money of many users converges, the haul from a single breach is at its maximum. The group hunts not for random wallets but for infrastructural "reservoirs."
Technically the attacks differ, but both are instructive. In the case of Ronin Bridge the target was the bridge itself — the mechanism that holds collateral assets for crossing between networks. Seizing control of the node, the attackers withdrew 173,600 ETH and 25.5M USDC. OFAC not only attributed the theft to Lazarus but also added the ETH address 0x098B716B8Aaf21512996dC57EB0615e2383E2f96 — which held the stolen ETH (around $400M at the time) — to the sanctions list. This is a rare and important precedent: a specific blockchain address becomes a sanctioned object.
The Bybit case is a textbook supply-chain attack. The mechanism was aimed not at the blockchain's cryptography but at the front end: malicious JavaScript was injected into the Safe{Wallet} interface hosted on AWS S3. When a scheduled transfer from a cold wallet to a hot wallet was taking place, the tampered interface showed the operators the "correct" transaction while in reality swapping out its data and siphoning off the funds. The stolen funds were then quickly converted into BTC and other assets and scattered across thousands of addresses; about $160M was laundered in the first 48 hours, and the FBI published 51 ETH addresses connected to the attack.
"Not your keys, not your coins."
— Andreas Antonopoulos, on control over keys and a verifiable transaction as the last line of defense
The Bybit case adds an important nuance to this maxim: even when you own the keys, you can lose coins if you are shown a swapped-out transaction to sign. A front-end attack bypasses the very idea of "checked it and signed it" — the operator signed what he saw, but what he saw was not what was happening. Hence the industry rule: a transaction should be verified on an independent device, not trusted to a single interface.
For the AML specialist the breach technique is secondary — what matters more is what happens to the money afterward. And here Lazarus has a recognizable signature: mixers, cross-chain (bridges, swaps) and OTC. In the Ronin case, for example, part of the funds passed through the Tornado Cash mixer, then the Ren bridge — and on into bitcoin. It was through Tornado Cash that the group laundered the Ronin funds, and this became one of the grounds for the unprecedented sanctions against the mixer's smart contract itself in 2022.
Lazarus's standard laundering pipeline
Breach of a bridge / exchange → Splitting across thousands of addresses → Mixer (Tornado Cash) → Cross-chain: Ren bridge → BTC → OTC / cash-out to fiat
Let's break down each stage in terms of why the attacker needs it and what it leaves behind for the analyst:
Note the speed separately. In the Bybit case a significant share was pushed into the laundering pipeline within the first two days, literally. A state-sponsored group does not dawdle: it counts on withdrawing the maximum before the industry coordinates and freezes the addresses. This sets a counter-task for the defense — to react just as fast, which is what gave rise to the practice of publishing lists of connected addresses (51 addresses for Bybit, the sanctioned address for Ronin) for immediate industry-wide blocking.
Facts are presented from open sources. This material is for educational purposes.