Data Shows North Korean Lazarus Group Has Accumulated Bitcoin Valued Over $40M

The North Korean hacking group known as Lazarus Group reportedly has holdings of over $47 million in cryptocurrency, with the majority in Bitcoin (BTC).

According to a report from the institutional crypto platform provider 21.co, wallets connected to Lazarus Group contain around 1,600 Bitcoin, 10,810 Ether (ETH), and 64,490 Binance Coin (BNB).

In total, the hacker group’s wallets contained crypto worth a staggering $75 million at the time of the report.

21.co compiled the data from a Dune Analytics dashboard that tracks 295 wallets identified by the US government as belonging to Lazarus Group.

Notably, the amount of crypto held by the group appears to have decreased from the $86 million it held on September 6, shortly after the Stake.com hack in which Lazarus was implicated.

The crypto casino Stake.com was hacked for about $40 million on September 4.

4/ Currently, the three largest holdings of Lazarus Group are BTC (~57%), ETH (~24%), and BNB (~18%)

On Aug 22, the FBI warned that ~1,580 BTC were on the move and that "the DPRK may attempt to cash out."

As of today, they haven’t been able to cash out the $42Mworth of BTC. pic.twitter.com/g4uSb96Ek3

— 21.co (@21co__) September 18, 2023

Actual amount likely higher

While the reported holdings are significant, 21.co believes that the actual amount may be much higher, and the estimate was called a “lower-bound estimation” based on publicly available information.

“If you have identified or are aware of any other hacks that have been disclosed, please contact us so we can track the assets in this dashboard,” the firm wrote in the report.

Long list of crypto heists

Lazarus Group’s activities includes the recent attack on crypto exchange CoinEx, which earlier in September was drained for at least $28 million worth of crypto.

Other major attacks that Lazarus Group is suspected to be behind includes the massive $620 million theft from Sky Mavis’ Ronin Bridge, a $100 million theft from Harmony’s Horizon Bridge, and a $100 million theft from Atomic Wallet.

According to the US government, half of North Korea’s missile funding comes from cybercrimes and crypto theft, and according to a White House official there is an ongoing effort to understand how a nation like North Korea “is so darn creative in this space.”