Lazarus Group
SECURITYDEFINITION
A hacking group widely attributed to North Korea's government, responsible for some of the largest cryptocurrency thefts on record — state-sponsored operations that fund the regime while evading international sanctions.
Security researchers and U.S. agencies have linked Lazarus Group to a string of major crypto breaches, including the $625 million Ronin Bridge hack in 2022 and the $1.5 billion Bybit breach in February 2025 — currently the largest cryptocurrency theft on record. The group is believed to operate under North Korea's Reconnaissance General Bureau, using stolen funds to help finance the country's weapons programs despite international sanctions.
Because Lazarus Group operates with state backing, its members rarely face arrest or prosecution. That's pushed victims toward a different remedy: civil litigation targeting the stolen assets directly. In August 2026, Bybit won a preliminary injunction in U.S. federal court freezing assets tied to the hack — a legal strategy that sidesteps the impossibility of extraditing state-sponsored hackers.
IN A SENTENCE
“You can't arrest Lazarus Group, so exchanges are learning to freeze its money instead.”
Key facts
Common questions
Why doesn't law enforcement just arrest Lazarus Group?
Its members are believed to operate from within North Korea under state protection, putting them outside the reach of U.S. and allied law enforcement. Civil courts can still freeze the stolen assets even without an arrest.
How does bitcoin's public ledger help trace stolen funds?
Every Bitcoin transaction is permanently visible on-chain. Chain-analysis firms can follow stolen funds through multiple hops of laundering, which is how investigators build the evidence behind asset freezes.