Lazarus Group Sends $3.76 Million in Bitcoin to Five Unknown Addresses
The Lazarus Group, a North Korean hacking collective, has been observed transferring Bitcoin to various unidentified addresses, reducing their total Bitcoin holdings to 13,441 BTC, as shown by on-chain data.
Data from Arkham Intelligence indicates that the Bitcoin (BTC) reserves of this North Korean hacker group are now valued at approximately $1.15 billion following these large transfers. On March 20 at around 9:18 AM UTC, the wallet dispatched 12.929 BTC, equivalent to $1.12 million, to an undisclosed wallet address.
Subsequent to the 12.929 BTC transaction, the wallet proceeded to send Bitcoin to four additional wallet addresses. Two unknown wallets received 0.308 BTC each, while one wallet received roughly 14.849 BTC, and another one got 15.684 BTC. In total, the wallet transferred over 44.07 BTC ($3.76 million) across five different wallet addresses within the last three hours.
The distribution of BTC holdings across multiple wallets by the Lazarus Group may suggest that the group is attempting to launder the funds, making it considerably more challenging to trace back.
Earlier today, Bybit CEO Ben Zhou stated that 88.87% of the stolen funds from the exchange remain traceable via on-chain data. Zhou noted that approximately 86.29% of the stolen assets—around $1.23 billion—have been converted into 12,836 Bitcoin and dispersed across as many as 9,117 wallets.
Zhou speculates that the hackers have employed Bitcoin mixers to obscure the transaction history, further complicating the tracing of the stolen funds.
As of the latest update, the wallet identified as belonging to the “Lazarus Group” by Arkham Intelligence currently contains 13,658 ETH (ETH), valued at approximately $27 million. Additionally, the wallet holds $3.17 million in BNB (BNB), $706,400 in DAI (DAI), and $288,870 in BABYDOGE (BABYDOGE). The remainder of the holdings consists of stablecoins like BUSD (BUSD), USDT (USDT), and USDC (USDC), with Bitcoin comprising the largest portion of their assets.
The Lazarus Group is a state-sponsored hacking organization from North Korea and has been operational since at least 2009. Their first known operation, titled “Operation Troy,” targeted the South Korean government.
The group’s most recent heist was a cyberattack on the Bybit crypto exchange, resulting in the platform incurring losses of approximately $1.4 billion. This incident is recognized as one of the largest crypto hacks in history.