North Korean Hacking Group Lazarus Withdraws $1.2M of Bitcoin From Coin Mixer
Lazarus Group, said to have been behind some $3 billion worth of cryptocurrency hacks and exploits over the past three years, appears to be moving around some of its bitcoin hoard. The group holds $79 million in wallets tagged by the blockchain analysis firm Arkham.
North Korean hackers Lazarus Group have moved $1.2 million worth of their ill-gotten gains from a coin mixer to a holding wallet, marking their largest transaction in over a month.
Data from the blockchain analysis firm Arkham shows that Lazarus Group's wallet received 27.371 bitcoin [BTC] in two transactions before sending out 3.34 BTC to a previously used wallet. The coin mixer wasn't identified.
Generally speaking, a coin mixer, sometimes referred to as a tumbler, is a blockchain-based protocol that can be used to obscure the ownership of cryptocurrencies by mixing them with coins from other users before redistributing them – so no one can tell who got what. Typically, the transparency of blockchains makes it a straightforward exercise to track the crypto's provenance and transfers.
Lazarus Group is said to have been behind $3 billion worth of cryptocurrency hacks and exploits over the past three years, according to a report by cybersecurity firm Recorded Future.
The U.S. Treasury Department has tied Lazarus Group to a $600 million theft of cryptocurrency from the Axie Infinity-linked Ronin bridge.
According to a report last week from TRM Labs, North Korea-affiliated hackers were involved in a third of all crypto exploits and thefts in 2023, making off with some $600 million in funds.
Read More: North Korea Was Responsible for Over $600M in Crypto Thefts Last Year: TRM Labs
The Lazarus Group wallet now holds $79 million in wallets tagged by Arkham, including $73 million worth of bitcoin and $3.4 million worth of ether [ETH].
Metamask developer Taylor Monahan said the recent Orbit attack, which resulted in the loss of $81 million, followed patterns similar to previous attacks committed by Lazarus Group.
More For You
Specialized AI detects 92% of real-world DeFi exploits

New research claims specialized AI dramatically outperforms general-purpose models at detecting exploited DeFi vulnerabilities.
What to know:
- A purpose-built AI security agent detected vulnerabilities in 92% of 90 exploited DeFi contracts ($96.8 million in exploit value), compared with 34% and $7.5 million for a baseline GPT-5.1-based coding agent running on the same underlying model.
- The gap came from domain-specific security methodology layered on top of the model, not differences in core AI capability, according to the report.
- The findings come as prior research from Anthropic and OpenAI shows AI agents can execute end-to-end smart contract exploits at low cost, accelerating concerns that offensive AI capabilities are scaling faster than defensive adoption.












