simply put
The North Korean-funded Lazarus Group is the 66th largest holder of Tron (TRX), holding $11.63 million worth.
The group reportedly holds $45.8 million in crypto assets, the bulk of which is Bitcoin ($42 million) and $640,000 in stablecoins.
The Lazarus Group allegedly used its illicit cryptocurrency proceeds to support North Korea’s missile program, stealing nearly $200 million in June and July.

According to on-chain data, the North Korean-funded hacker group Lazarus Group is a TRON whale. Moreover, it has been rampant recently, making illegal gains from crypto platforms.
On September 26, blockchain security company PeckShield reported that CoinEx Drainer held more than 137 million TRX, worth approximately $11.63 million.
Lazarus Group Holdings continues to grow
This represents 0.154% of TRON’s total supply, making it the 66th-largest TRX holder, it added. TRX’s total supply is 89 billion and its market cap is $7.5 billion.

On September 12, the CoinEx exchange was hacked, and the platform lost up to $55 million. About one-fifth of it was Tron’s native token TRX. In addition, the token is currently trading at $0.084, up 8% in the past two weeks.
In addition, according to blockchain security company SlowMist, the North Korean hacker group Lazarus was responsible for the attack. CoinEx resumed some cryptocurrency deposit and withdrawal services on September 21.
According to the Dune Analytics dashboard from 21 Shares parent company 21.co, the Lazarus Group currently holds $45.8 million worth of crypto assets.
Its holdings surged to over $80 million in January and early September, the latter following a $41 million hack of Stake.com.
While Lazarus holds a large amount of TRX, the majority of its holdings are in Bitcoin. According to Dune, the cybercrime group has approximately $42 million worth of BTC.

It also holds $640,000 in stablecoins, primarily Binance Dollar (BUSD).
According to the FBI, Lazarus stole nearly $200 million from Atomic Wallet, Alphapo and CoinsPaid in June and July.
Researchers frequently report that the group has used its ill-gotten gains to support North Korea’s missile program.
The hacker rampage continues
According to crypto security firm Elliptic, five Lazarus attacks occurred over 104 days, netting the criminal group around $240 million.
The firm observed that some of the funds stolen from CoinEx were sent to an address used to launder funds stolen from Stake. It also noted a change in strategy this year:
“Analysis of Lazarus’ recent activity suggests that it has shifted its focus from decentralized to centralized services since last year.”
It also reported that the group prefers to use social engineering as an attack vector. It warned that Lazarus malware was used to carry out sophisticated phishing attacks targeting employees of centralized cryptocurrency providers.