Lazarus Group is the umbrella name for North Korea’s state hacking units. It operates under the Reconnaissance General Bureau, the country’s military intelligence agency, and its job is to steal money for the regime. Since 2017, it has taken well over $12 billion in crypto, including the two largest heists ever: Binance for $6.3 billion in October 2026 and Bybit for $1.5 billion in February 2025.
This post explains who Lazarus actually is, which subunits do the hacking, how they get inside crypto companies and where the money goes. If you want the full timeline of their heists instead, read our earlier post on Lazarus Group crypto hacks.
Why one country’s hackers matter to you
I have been farming airdrops and trading since 2013, so I have watched Lazarus grow from a nuisance into the single biggest risk in crypto. In 2025 they drained Bybit while I still had trading capital on it. Then in 2026 they hit Bitget, Drift, KelpDAO and finally Binance. Four of the five biggest exchange hacks ever now carry their name.
That matters because their targets are the places you keep your money. Not random DeFi forks, but the largest exchanges, the biggest bridges and the wallet software you trust. Understanding how they work is therefore part of protecting your own stack.
Who runs Lazarus Group
Lazarus is not a gang in the usual sense. It is a department of the North Korean state. Western intelligence agencies place it under the Reconnaissance General Bureau, which reports directly to the country’s leadership. Its hackers are recruited young, trained at state universities and then posted abroad, often to China, Russia or Southeast Asia, where the internet actually works.
The name itself comes from security researchers, not from Pyongyang. After the 2014 Sony Pictures hack, analysts needed a label for the activity and picked Lazarus. The group had already been active for years by then. In 2016 it stole $81 million from Bangladesh Bank through the SWIFT system. In 2017 it released WannaCry, the ransomware that shut down hospitals across the UK. Crypto only became the main target after that, because it was easier to steal and much harder to claw back.
Estimates from the UN Panel of Experts suggest cyber theft funds somewhere between a third and half of North Korea’s missile and nuclear programmes. In other words, every exchange hack on this site helps pay for a weapons test.
The subunits that actually do the hacking
Lazarus is better understood as several teams with different specialities. The names come from the FBI, Microsoft, Mandiant and other researchers, so the same unit can carry three labels at once.
TraderTraitor, also tracked as Jade Sleet and UNC4899, is the unit behind Binance, Bybit and DMM Bitcoin. The FBI first used the name in 2022 for a campaign of fake trading apps aimed at crypto employees. Today it is the elite team, and it goes after the biggest centralized exchanges through their developers and suppliers. The Binance hack post mortem shows the current playbook: one compromised DevOps laptop, then a service container, then $6.3 billion gone.
AppleJeus is the older unit that built trojanised trading software. Victims downloaded what looked like a portfolio tool or a trading terminal. Instead, it installed malware that stole keys from the machine.
BlueNoroff, also called APT38, started with banks and the SWIFT network. Since then it has moved to crypto startups and venture funds, usually by posing as investors.
The IT worker network is the newest and strangest arm. Thousands of North Koreans work remote developer jobs under fake identities, mostly for Western crypto companies. Their salaries go to the regime. Some of them also plant backdoors or leak access to the hacking units. In April 2026, ZachXBT published data from a leaked internal payment server with 390 accounts, chat logs and salary records. He also noted this group is far less skilled than TraderTraitor, which makes it the one you are most likely to meet.
How Lazarus gets inside
Almost none of the big Lazarus hacks started with a bug in a blockchain. Instead, they started with a person.
Operation Dream Job is the classic. A recruiter on LinkedIn offers a developer a well-paid role, sends over a coding test or a PDF, and the file carries malware. The Ronin bridge lost $625 million in 2022 after one engineer opened a fake job offer. Four years later, the same trick still works.
Contagious Interview flips it around. Here, the North Koreans pose as the hiring company. Candidates get asked to run a “take-home test” from a GitHub repository, and the repo installs an infostealer.
Supply chain attacks are the expensive version. For the Bybit hack, TraderTraitor did not touch Bybit at all. They compromised a developer at Safe, the multisig provider, and altered the interface Bybit signers saw on screen. The Bybit hack post mortem walks through how that one machine cost $1.5 billion. Bitget’s backend wallet system was breached the same way in September 2026, which I covered live in the Bitget hack post.
Long-game social engineering is the newest escalation. For Drift Protocol in April 2026, operators spent six months building relationships, including in-person meetings, until they held enough admin keys. Our Drift exploit explainer covers that operation. Two weeks later, KelpDAO lost $292 million after attackers poisoned its RPC nodes, which we broke down in the KelpDAO exploit explainer.
The pattern is always the same. Find the human with access, then take over the machine, then sign the withdrawal.
Where the money goes
Stealing is step one. Laundering billions is the harder problem, and Lazarus has turned it into an assembly line.
First, stablecoins get swapped into ETH or BTC within minutes, because Tether and Circle can freeze USDT and USDC but nobody can freeze Ether. In the Binance case, the issuers still managed to freeze more than $2.3 billion, mostly because the volume was too big to move fast enough.
Next, the coins go through mixers and cross-chain bridges. Tornado Cash was the favourite until sanctions, then Sinbad, then THORChain for moving ETH into BTC. Our explainer on Tornado Cash and crypto mixers shows how that layer works.
After that, the funds reach Chinese-language OTC networks, many of them based in Cambodia and Southeast Asia, which convert crypto into cash for a fee. ZachXBT posed as a client of one of these networks and traced more than $1 billion in Lazarus proceeds through it. Our post on ZachXBT tracking Lazarus covers that investigation.
Finally, some of the haul ends up in privacy coins. Monero hides sender, receiver and amount, so once stolen funds become XMR the trail usually ends. That is a big part of why exchanges keep delisting it, as our deep dive on whether Monero is the best privacy coin explains.
The Lazarus scorecard
By year, according to Chainalysis, Elliptic and TRM Labs. All figures are approximate.
2022: about $1.7 billion, including Ronin ($625 million) and Harmony Horizon ($100 million).
2023: about $660 million, including Atomic Wallet, Stake.com, CoinEx and Poloniex.
2024: about $1.3 billion, including DMM Bitcoin ($305 million) and WazirX ($235 million).
2025: more than $2 billion, dominated by Bybit ($1.5 billion) and Phemex ($85 million).
2026: more than $7.5 billion, with Drift ($285 million), KelpDAO ($292 million), Bitget ($387.5 million) and Binance ($6.3 billion).
In short, 2026 alone outstripped every previous year combined. Both of our hack rankings, the biggest exchange hacks and the biggest crypto hacks across DeFi, bridges and wallets, have Lazarus at the top and throughout the middle.
How to spot a North Korean operative
Most readers will never be targeted by TraderTraitor. However, plenty of people in crypto will cross paths with the IT worker network, especially anyone who hires developers or runs a small project. A few patterns show up again and again.
The candidate refuses to turn on a camera, or the video freezes at convenient moments. The CV is strong but the work history is a chain of short remote contracts. Payment has to go to a third party or a different name. Time zones never quite line up with the claimed location.
One filter that went viral in 2026 is blunt but effective. Ask the candidate, on camera, to say something critical about Kim Jong Un. Criticising the leader is a crime in North Korea, so genuine operatives freeze or drop the call. It will not work forever, but right now it does.
For everyone else, the rules are simpler. Never run a coding test or open a document from a recruiter you did not contact first. Treat any unsolicited GitHub repo as hostile. And assume that a job offer which sounds too good is bait.
What this means for your funds
Lazarus goes where the money is, so the biggest exchanges will keep getting hit. The good news is that Binance, Bybit and Bitget all repaid their users in full. The bad news is that Drift and KelpDAO users were not so lucky, because DeFi protocols rarely have a reserve fund.
My approach has not changed. Trading capital on two or three exchanges that have proven they can absorb a Lazarus-sized loss, farming capital spread across many wallets, and the rest in self custody. When a hack hits, withdraw first and read the post mortem later. If you ever lose funds to one of these attacks, read can stolen crypto be recovered before trusting anyone who promises to get it back. Our stay safe guide covers the rest of the checklist.
Keep This Content Free
Lazarus has drained four of the five largest exchanges in history, yet every user on those platforms got their money back. That only happened because the exchanges had real reserves. OKX and Bybit both publish proof of reserves, and Bybit has already survived the test. Signing up through our links gets you their welcome bonus and keeps our hack coverage running.
Final Words
Lazarus Group is not a hacker collective. It is a government department with a budget, a recruitment pipeline and a laundering network that stretches from Pyongyang to Phnom Penh. Its tools are mostly fake job offers and patient social engineering, not zero-days. That is exactly why it keeps winning against companies that spend millions on code audits.
The industry will not stop them. Sanctions have not, arrests of launderers have not, and the FBI naming them within days of each hack has not. So the defence falls to you. Keep your funds spread out, treat every recruiter as a potential attacker, and move first when the next alarm goes off. I will keep this page updated as the units, tactics and totals change.
FAQ
Who is the Lazarus Group?
Lazarus Group is the collective name for North Korea’s state-sponsored hacking units, operating under the Reconnaissance General Bureau. It steals cryptocurrency and fiat to fund the regime, including its weapons programmes, and has taken more than $12 billion in crypto since 2017.
What is the difference between Lazarus and TraderTraitor?
TraderTraitor is a subunit inside Lazarus. The FBI uses the name for the team that targets crypto exchanges through their developers and suppliers. It is responsible for the Binance, Bybit and DMM Bitcoin hacks, among others.
How does Lazarus Group hack crypto exchanges?
Mostly through people rather than code. Fake job offers, poisoned coding tests, compromised supplier laptops and months-long social engineering campaigns give them access to the machines that sign withdrawals.
How much has Lazarus stolen in 2026?
More than $7.5 billion, including Binance ($6.3 billion), Bitget ($387.5 million), KelpDAO ($292 million) and Drift ($285 million). That is more than every previous year combined.
Does Lazarus Group ever get caught?
The hackers themselves, no. They operate from inside North Korea or from allied countries. Launderers in their network have been arrested, and stablecoin issuers have frozen billions, but the core team has never faced prosecution. Pyongyang also denies every attribution, including Binance and Bybit, which it called a US provocation.
Why does North Korea steal crypto?
Sanctions cut the country off from most of the global financial system. Crypto theft gives the regime hard currency that is difficult to trace and impossible to sanction. UN experts estimate it funds a large share of the missile and nuclear programmes.
How do I protect myself from Lazarus?
Keep only trading capital on exchanges, spread it across platforms with proven reserve funds, and hold the rest in self custody. Never open files or run code from unsolicited recruiters, and withdraw first when a hack is reported.
