AMLConsensus · course
Programme · Lesson 11.8
Section 11 · Lesson 11.8 · case study

Lazarus Group: How the North Korean State Steals Billions

Most crypto thefts are committed by lone actors and small crews out for a quick score. But there is a player of a different scale — the state-sponsored hacking group of North Korea. For it, breaking into exchanges and bridges is not an adventure but a line in the budget: the stolen billions go toward the regime's programs. To understand how Lazarus operates is to understand where the industry's most "toxic" crypto comes from.

Who Lazarus is, and why this is a special case

Lazarus Group is a state-sponsored hacking group of North Korea, and that changes everything. An ordinary thief fears getting caught, is limited in resources and acts chaotically. A state-sponsored group works differently: it has staff, time, patience and political cover. It is not trying to hide from its own country — on the contrary, it acts in that country's interests. According to investigators and sanctions bodies, the stolen funds go toward the regime's programs, which moves these thefts out of the criminal realm and into the realm of national security.

This is exactly why Lazarus is rightly called the industry's chief "supplier" of stolen crypto. When you run into an address in a check that is tagged as linked to this group, you are dealing not simply with dirty money but with funds under sanctions and geopolitical scrutiny. Getting it wrong here is especially costly.

A chronicle of high-profile thefts

The group is credited with billions of dollars stolen from crypto venues and infrastructure. Let's go through the confirmed cases from our dossier.

Note the pattern in the choice of targets. Ronin and Harmony are bridges and sidechains, the nodes through which assets move between blockchains. Bybit is a large exchange. Atomic Wallet is a wallet. All of these are points where other people's funds concentrate: where the money of many users converges, the haul from a single breach is at its maximum. The group hunts not for random wallets but for infrastructural "reservoirs."

How they steal: from Ronin to Bybit

Technically the attacks differ, but both are instructive. In the case of Ronin Bridge the target was the bridge itself — the mechanism that holds collateral assets for crossing between networks. Seizing control of the node, the attackers withdrew 173,600 ETH and 25.5M USDC. OFAC not only attributed the theft to Lazarus but also added the ETH address 0x098B716B8Aaf21512996dC57EB0615e2383E2f96 — which held the stolen ETH (around $400M at the time) — to the sanctions list. This is a rare and important precedent: a specific blockchain address becomes a sanctioned object.

The Bybit case is a textbook supply-chain attack. The mechanism was aimed not at the blockchain's cryptography but at the front end: malicious JavaScript was injected into the Safe{Wallet} interface hosted on AWS S3. When a scheduled transfer from a cold wallet to a hot wallet was taking place, the tampered interface showed the operators the "correct" transaction while in reality swapping out its data and siphoning off the funds. The stolen funds were then quickly converted into BTC and other assets and scattered across thousands of addresses; about $160M was laundered in the first 48 hours, and the FBI published 51 ETH addresses connected to the attack.

"Not your keys, not your coins."

— Andreas Antonopoulos, on control over keys and a verifiable transaction as the last line of defense

The Bybit case adds an important nuance to this maxim: even when you own the keys, you can lose coins if you are shown a swapped-out transaction to sign. A front-end attack bypasses the very idea of "checked it and signed it" — the operator signed what he saw, but what he saw was not what was happening. Hence the industry rule: a transaction should be verified on an independent device, not trusted to a single interface.

How they launder: the standard pipeline

For the AML specialist the breach technique is secondary — what matters more is what happens to the money afterward. And here Lazarus has a recognizable signature: mixers, cross-chain (bridges, swaps) and OTC. In the Ronin case, for example, part of the funds passed through the Tornado Cash mixer, then the Ren bridge — and on into bitcoin. It was through Tornado Cash that the group laundered the Ronin funds, and this became one of the grounds for the unprecedented sanctions against the mixer's smart contract itself in 2022.

Lazarus's standard laundering pipeline

Breach of a bridge / exchange  →  Splitting across thousands of addresses  →  Mixer (Tornado Cash)  →  Cross-chain: Ren bridge → BTC  →  OTC / cash-out to fiat

Let's break down each stage in terms of why the attacker needs it and what it leaves behind for the analyst:

  1. Splitting. A single large sum is broken up across thousands of addresses to "blur" the trail and make freezing harder. But fan-out splitting is itself already a pattern that is visible in the blockchain.
  2. Mixer. Funds are run through a mixing service (for example, Tornado Cash) to sever the input-output link. However, the very fact of transit through a known mixer is a red flag of the highest risk level.
  3. Cross-chain. Through bridges and swaps the coins are moved into another network (say, into bitcoin), in the hope that the trail will "break off" at the border between blockchains. Modern tracing is able to cross these borders too.
  4. OTC and cash-out to fiat. The final stage — exchanging for "clean" assets or cashing out off the exchange order books. This is the very weak link where crypto meets the real world.

Note the speed separately. In the Bybit case a significant share was pushed into the laundering pipeline within the first two days, literally. A state-sponsored group does not dawdle: it counts on withdrawing the maximum before the industry coordinates and freezes the addresses. This sets a counter-task for the defense — to react just as fast, which is what gave rise to the practice of publishing lists of connected addresses (51 addresses for Bybit, the sanctioned address for Ronin) for immediate industry-wide blocking.

What this means for the compliance checker

What this case teaches. Lazarus Group is the industry's chief "supplier" of stolen crypto, and its signature sets the standard for what counts as the highest level of risk. The attacks target infrastructural nodes (bridges, exchanges, wallets), and the laundering runs along a recognizable pipeline: splitting → mixer → cross-chain → OTC. For the AML specialist this is a threat map: a link to sanctioned addresses, transit through mixers and cross-chain transitions are exactly the signals that must not be missed and must not be "forgiven" for age.

Facts are presented from open sources. This material is for educational purposes.