North Korea’s Lazarus Group Launders $1B in Crypto in Record Time
The North Korean state-sponsored hacking group Lazarus has once again pulled off a massive crypto heist—this time laundering over $1 billion worth of Ethereum (ETH) and derivatives in less than two weeks. Despite the speed of their operation, analysts believe there’s still hope of recovering some of the stolen funds.
A $1.5 Billion Heist and a Rapid Laundering Operation
The attack targeted Bybit, a major crypto exchange, with hackers making off with nearly 500,000 ETH. At the time of the theft, the stolen assets were valued at approximately $1.5 billion. According to blockchain analysts from Lookonchain, Nansen, and Arkham, the hackers have now emptied their wallets, quickly converting and dispersing the funds.
A key player in this laundering scheme? THORChain, a decentralized exchange that recently faced financial struggles. The platform provided Lazarus with a convenient way to swap ETH for Bitcoin (BTC) without the oversight of centralized exchanges.
Stolen Funds: Where They Went
As of March 4, Bybit CEO Ben Zhou provided an update on the stolen funds:
• 77% remain traceable
• 20% have gone dark (meaning they’ve been obfuscated through mixers or hard-to-track methods)
• 3% have been frozen
Lazarus converted 83% of the stolen ETH into Bitcoin, distributing it across 6,954 wallets. The hackers also leveraged ExCH, a crypto exchange that publicly clashed with Bybit after the hack, as well as a proxy of OKX, one of the world’s largest trading platforms.
Hong Fang, President of OKX, stated that the company has been “continuously updating [its] blacklist addresses” in an attempt to block the hackers’ transactions.
“For self-custody wallets, all on-chain transactions should be traceable,” Fang added.
The Race to Freeze the Funds
The window to recover any of the stolen funds is closing fast. Zhou warned that the next two weeks are critical, as the hackers will attempt to cash out through centralized exchanges, over-the-counter (OTC) trading, and peer-to-peer (P2P) markets.
To fight back, Bybit has enlisted bounty hunters, offering rewards for identifying and freezing the stolen assets. So far, more than $2 million in bounties have been paid, with 19 registered hunters actively tracking the funds through LazarusBounty.com.
The Hacker’s Method: A Relentless, Systematic Approach
One Arkham analyst observed a highly disciplined pattern in the hacker’s movements:
“The Bybit Hacker is making 2-3 transactions per minute and stops every 45 minutes for a 15-minute break. They move ETH from one address at a time before moving on to the next one.”
This level of precision suggests that Lazarus operates on a structured schedule, possibly using automated scripts or a well-coordinated team to execute the laundering process efficiently. The relentless pace and strategic breaks point to an operation designed for both speed and stealth, minimizing the risk of detection while maximizing the volume of funds moved.
What Happens Next?
The laundering of such a large amount of crypto in record time highlights a growing challenge in crypto security and regulatory enforcement. While blockchain analysis firms, exchanges, and law enforcement agencies continue working to track and freeze the stolen assets, the decentralized nature of many laundering methods makes complete recovery unlikely.
However, Bybit’s efforts—along with the contributions of bounty hunters and security researchers—have already led to partial successes, freezing millions in stolen funds. Whether more can be recovered depends on how quickly exchanges and law enforcement act before the hackers finish offloading their remaining assets.
Meanwhile, THORChain’s role in the laundering process raises further questions about the risks posed by decentralized exchanges (DEXs) that allow criminals to move funds with minimal oversight. With Lazarus consistently exploiting weak links in crypto infrastructure, it’s likely that new security measures and regulatory pressures will follow in an attempt to curb future attacks.
For now, the race is on—with billions at stake.
