Lazarus group moves $7.7M in bitcoin after record $577M theft year

North Korea's Lazarus Group shifted 121.5 Bitcoin worth $7.74 million on Thursday, reigniting concerns over how stolen crypto flows through the financial system.

A wallet cluster tied to North Korea's Lazarus Group moved 121.5 Bitcoin, worth $7.74 million, roughly an hour before blockchain analytics firm Lookonchain flagged the transaction on Thursday.

"The movement of funds from wallets linked to Lazarus Group is significant because each transaction has the potential to bring stolen cryptocurrency closer to conversion into fiat currency," Nick Carlsen, a former FBI analyst now at TRM Labs, said.

TRM Labs estimated that North Korea-linked hackers stole about $577 million in cryptocurrency through April 2026, accounting for 76 percent of all crypto hack value this year. Nearly all of it came from two attacks: a $285 million exploit of Drift Protocol on April 1 and a $292 million attack on a KelpDAO bridge on April 18. Since 2017, North Korean hackers have stolen over $6 billion in digital currencies, cementing their status as the world's most prolific state-sponsored cyber threat.

The transfer follows a pattern Carlsen described as "flood the zone," where the group triggers numerous transactions across multiple platforms within a brief period to confuse investigators. After the $1.5 billion Bybit hack in February 2025, the group routed stolen Ether through THORChain to convert it into Bitcoin before sending portions through mixers such as Wasabi Wallet and CryptoMixer, according to TRM Labs. The latest movement of 121.5 BTC may signal the start of another laundering cycle, putting exchanges and over-the-counter desks on alert for potential liquidation pressure.

The Lazarus Group remains under US Treasury sanctions as part of the DPRK3 program administered by the Office of Foreign Assets Control. Any entity handling funds traced to Lazarus-linked addresses faces sanctions risk, meaning the flagged wallets must be treated as an immediate compliance concern. The FBI has formally attributed multiple crypto thefts to the group, including the $100 million Harmony Horizon Bridge hack in 2022 and the Bybit exploit.

For Bitcoin holders, the movement of stolen funds introduces a near-term overhang. If the group begins distributing the 121.5 BTC across exchanges, it could exert downward pressure on price, though the amount represents a fraction of Bitcoin's daily trading volume. The broader risk lies in the regulatory response: each high-profile laundering event strengthens the case for stricter know-your-customer rules on decentralized platforms and mixers, potentially reshaping how liquidity flows through the crypto ecosystem.

This article is for informational purposes only and does not constitute investment advice.