Share this article

North Korean Hacking Group Lazarus Withdraws $1.2M of Bitcoin From Coin Mixer

Lazarus Group, said to have been behind some $3 billion worth of cryptocurrency hacks and exploits over the past three years, appears to be moving around some of its bitcoin hoard. The group holds $79 million in wallets tagged by the blockchain analysis firm Arkham.

Updated Mar 8, 2024, 7:29 p.m. Published Jan 8, 2024, 3:08 p.m.
jwp-player-placeholder

North Korean hackers Lazarus Group have moved $1.2 million worth of their ill-gotten gains from a coin mixer to a holding wallet, marking their largest transaction in over a month.

Data from the blockchain analysis firm Arkham shows that Lazarus Group's wallet received 27.371 bitcoin [BTC] in two transactions before sending out 3.34 BTC to a previously used wallet. The coin mixer wasn't identified.

STORY CONTINUES BELOW
Don't miss another story.Subscribe to the Crypto Daybook Americas Newsletter today. See all newsletters

Generally speaking, a coin mixer, sometimes referred to as a tumbler, is a blockchain-based protocol that can be used to obscure the ownership of cryptocurrencies by mixing them with coins from other users before redistributing them – so no one can tell who got what. Typically, the transparency of blockchains makes it a straightforward exercise to track the crypto's provenance and transfers.

Lazarus Group is said to have been behind $3 billion worth of cryptocurrency hacks and exploits over the past three years, according to a report by cybersecurity firm Recorded Future.

The U.S. Treasury Department has tied Lazarus Group to a $600 million theft of cryptocurrency from the Axie Infinity-linked Ronin bridge.

According to a report last week from TRM Labs, North Korea-affiliated hackers were involved in a third of all crypto exploits and thefts in 2023, making off with some $600 million in funds.

Read More: North Korea Was Responsible for Over $600M in Crypto Thefts Last Year: TRM Labs

The Lazarus Group wallet now holds $79 million in wallets tagged by Arkham, including $73 million worth of bitcoin and $3.4 million worth of ether [ETH].

Metamask developer Taylor Monahan said the recent Orbit attack, which resulted in the loss of $81 million, followed patterns similar to previous attacks committed by Lazarus Group.


More For You

Protocol Research: GoPlus Security

GP Basic Image

What to know:

  • As of October 2025, GoPlus has generated $4.7M in total revenue across its product lines. The GoPlus App is the primary revenue driver, contributing $2.5M (approx. 53%), followed by the SafeToken Protocol at $1.7M.
  • GoPlus Intelligence's Token Security API averaged 717 million monthly calls year-to-date in 2025 , with a peak of nearly 1 billion calls in February 2025. Total blockchain-level requests, including transaction simulations, averaged an additional 350 million per month.
  • Since its January 2025 launch , the $GPS token has registered over $5B in total spot volume and $10B in derivatives volume in 2025. Monthly spot volume peaked in March 2025 at over $1.1B , while derivatives volume peaked the same month at over $4B.

More For You

Cascade Unveils 24/7 Neo-Brokerage Offering Perpetuals on Cryptos, U.S. Stocks

Computer monitors and a laptop screen show trading charts on a desk overlooking an expanse of water at sunset. (sergeitokmakov/Pixabay, modified by CoinDesk)

The platform will let retail traders use one margin account to trade round-the-clock perpetual markets.

What to know:

  • Cascade has introduced a 24/7 brokerage-style app for perpetual markets spanning crypto, U.S. equities and private-asset exposure.
  • The firm is pitching a single, unified margin account with direct-to-bank U.S. dollar capability for deposits and withdrawals.
  • The company has raised $15 million from investors including Polychain Capital, Variant and Coinbase Ventures.