North Korea-linked Lazarus Group has transferred 244.148 Bitcoin worth about $19.42 million, bringing fresh attention to wallets associated with one of the crypto industry's most active hacking operations.
Key Takeaways
Lazarus Group transferred 244.148 BTC worth about $19.42 million, according to Lookonchain
The transaction's destination and connection to any earlier theft remain undisclosed
Another Lazarus-linked wallet moved 262.2 BTC to a new address earlier in August
U.S. sanctions generally prohibit Americans from dealing with Lazarus-linked property
Lazarus Group Moves 244 BTC Between Wallets
Lookonchain reported the transfer in an Aug. 28 X post, saying wallets attributed to Lazarus Group had become active again and moved 244.148 BTC about an hour before its alert. Bitcoin traded at roughly $79,500 when the analytics account published its estimate, placing the transaction's value at $19.42 million. Lookonchain did not identify the receiving address or say whether the Bitcoin moved to an exchange, mixer, or another wallet controlled by the group.
Without a disclosed destination, the transaction alone does not show that Lazarus sold or attempted to cash out the Bitcoin. The Aug. 28 transaction followed another large Bitcoin movement attributed to the group earlier in August. On Aug. 12, Lookonchain said Lazarus transferred 262.2 BTC, then valued at approximately $16.64 million, from an identified wallet to a newly created address. This connects to the broader security landscape covered in CoinGecko's report on $3.63B in crypto hacks and the Ledger hack claim.
Bybit Theft Left Bitcoin Across Thousands of Addresses
As previously reported, Bybit sued North Korea and Lazarus Group in a Washington, D.C., federal court on Aug. 7, seeking to recover assets tied to the exchange's $1.5 billion theft. The lawsuit also named North Korea's Reconnaissance General Bureau. A federal judge issued a preliminary injunction blocking unidentified defendants from transferring, selling, or disposing of certain assets connected to the case.
The FBI attributed the February 2025 Bybit attack to North Korean actors operating under the TraderTraitor name. The attackers converted part of the stolen holdings into Bitcoin and other assets before spreading them across thousands of addresses on several blockchains. By April 2025, Bybit CEO Ben Zhou said 27.6% of the stolen funds could no longer be tracked.
Lazarus-Linked Attacks Continued Into 2026
Chainalysis estimated that North Korean hackers stole at least $2.02 billion in cryptocurrency during 2025, an increase of 51% from the previous year. The firm placed the country's cumulative crypto theft at no less than $6.75 billion. Activity attributed to Lazarus continued in April 2026 when attackers drained approximately 116,500 rsETH, worth about $292 million, from KelpDAO's LayerZero-based bridge. LayerZero attributed the attack with preliminary confidence to Lazarus Group's TraderTraitor unit. This attack pattern connects to the Moonwell MAMO exploit and broader DeFi security concerns.
U.S. Sanctions Restrict Dealings With Lazarus Group
The U.S. Treasury's Office of Foreign Assets Control sanctioned Lazarus Group in September 2019 under an executive order targeting the North Korean government. OFAC identified Lazarus, Bluenoroff, and Andariel as state-controlled hacking groups. Under the designation, property belonging to Lazarus that enters the United States or comes under the possession of a U.S. person must be blocked and reported to OFAC. Treasury linked the group to the 2014 Sony Pictures breach and the WannaCry ransomware attack that affected computers across at least 150 countries.
