North Korean Hacking Group Lazarus Launders Over 1 Billion$ in Cryptocurrency in Less Than Two Weeks

5 March 2025 2 minutes Author: Newsman

North Korean hacking group Lazarus laundered over $1 billion in cryptocurrency stolen from crypto exchange Bybit in less than two weeks. Experts have confirmed that most of the funds went through decentralized exchange THORChain, but some assets can still be traced.

Most analysts at Lookonchain, Nansen, and Arkham have documented that the hackers’ wallets, which previously held nearly 1.5 billion$, have been completely emptied; as of March 4, Bybit CEO Ben Zhou confirmed that 500,000 ETH and its derivatives were stolen. Analysts at Lookonchain, Nansen, and Arkham have documented the complete emptying of the hackers’ wallet, which previously held nearly 1.5 billion$. As of March 4, Bybit CEO Ben Zhou reported that of the 500,000 ETH and its derivatives stolen:

  • 77% is still traceable,
  • 20% has disappeared from sight,
  • 3% is frozen.

The Lazarus Group, which has ties to North Korea, is not the first group to commit large-scale cryptocurrency thefts. The latest incident is a continuation of their attacks aimed at financing the North Korean regime; Lazarus is known to use sophisticated money laundering schemes, including decentralized exchanges, peer-to-peer trading, and cryptocurrency exchange bypasses.

The next few weeks will be crucial for the freezing of money, as funds will begin to flow through centralized exchanges and over-the-counter services. Experts advise users to avoid unsafe platforms and check their trading addresses against blacklists.

Other related articles
News
Read more
Qilin hackers attacked Houston Symphony and stole over 300 GB of data
Qilin attacked the Houston Symphony Orchestra and stole over 300 GB of financial and personal data. The hackers threatened to release the documents on March 5 if the organization did not agree to negotiations. Qilin has previously attacked medical and industrial organizations in the US and Europe. Experts advise to strengthen security to prevent similar attacks.
63
News
Read more
Zero-Day in BigAnt Server allows attackers to execute malicious code via file upload
The zero-day vulnerability CVE-2025-0364 in BigAnt Server allows unauthenticated attacks using SaaS registration and PHP file upload. The vulnerability allows attackers to gain NT AUTHORITY\SYSTEM privileges via Cloud Drive. BigAntSoft has not released a fix, so it is recommended to block SaaS registration and monitor the activity of PHP processes.
64
News
Read more
Eleven11bot botnet attacks telecom companies and gaming platforms
A large-scale botnet consisting of hacked security cameras and DVRs is attacking telecommunications companies and gaming platforms. Researchers have identified over 1,000 active IP addresses, most of which originate from Iran. The DDoS attacks are carried out using brute force via Telnet and SSH, and the main targets are devices with built-in passwords.
68
Found an error?
If you find an error, take a screenshot and send it to the bot.