Lazarus Group moves $19.4 million in Bitcoin amid renewed activity

North Korea‑linked cyber‑crime group Lazarus transferred 244.148 Bitcoin, worth roughly $19.42 million at a price of $79,500 per BTC, according to blockchain analytics firm Lookonchain. The move was reported on August 28 and marks the latest wallet‑to‑wallet transaction attributed to the group.

Details of the August 28 transfer

Lookonchain noted that the Bitcoin moved between two addresses associated with Lazarus but did not disclose the destination address or indicate whether the funds were sent to an exchange, mixer, or another controlled wallet. Without that information, the transaction alone does not confirm a sale or cash‑out attempt.

Recent related activity

• On August 12, Lazarus moved 262.2 BTC (about $16.64 million) to a newly created address, also described as a wallet‑to‑wallet transfer.
• Combined, the two August movements involve more than $36 million in Bitcoin, though sources have not confirmed a common source balance.
• In March 2025, Lazarus‑linked wallets sent 44.07 BTC (about $3.76 million) to five unknown addresses, reducing the tracked wallet’s holdings to 13,441 BTC.

Legal and regulatory context

The U.S. Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Lazarus Group in September 2019, prohibiting U.S. persons from dealing with property linked to the group. A preliminary injunction issued in a federal lawsuit filed by Bybit on August 7 blocks the transfer, sale, or disposal of assets tied to the $1.5 billion Bybit theft, though no direct link between the August 28 Bitcoin move and the Bybit case has been established.

Broader threat landscape

Chainalysis estimates North Korean hackers stole at least $2.02 billion in cryptocurrency during 2025, bringing the cumulative total to $6.75 billion. The group’s activities have expanded to include large‑scale thefts such as the April 2026 drain of approximately 116,500 rsETH (about $292 million) from KelpDAO’s bridge, attributed with preliminary confidence to Lazarus’s TraderTraitor unit.

Implications

The renewed Bitcoin movement underscores the difficulty of tracing illicit funds once they are split across multiple addresses and services. While blockchain records confirm the transfer, attribution relies on labeling by intelligence firms, and the lack of a disclosed destination leaves uncertainty about the group’s next steps.