If the goal of an ordinary hacker is to steal data, the targets of the Lazarus Group have long gone beyond the realm of traditional cybercrime.
For more than a decade, this hacking group, which the U.S. government has identified as being linked to North Korea, has continued to attack banks, financial institutions, technology companies, and cryptocurrency projects around the world. From the attack on Sony Pictures to the theft of $81 million from the Central Bank of Bangladesh, and then the hacks of the Ronin cross-chain bridge and the Harmony network, as well as the theft of nearly $1.5 billion in assets from Bybit in 2025, Lazarus-linked operations have repeatedly reshaped the global financial industry’s understanding of cybersecurity risks.
Their attacks target not only system vulnerabilities, but also trust between people, internal corporate permissions, and the security boundaries of the entire financial infrastructure.
I. What Exactly Is the Lazarus Group?
The Lazarus Group, also known as Lazarus, is a term used in the cybersecurity industry to describe a range of cyberattacks associated with North Korea.
In 2019, the U.S. Treasury formally sanctioned the Lazarus Group and stated that it was linked to North Korea's Reconnaissance General Bureau.
The associated attack activity has involved infiltrating financial institutions, stealing trade secrets, deploying ransomware, stealing cryptocurrency, and disrupting network infrastructure. Cybersecurity research also frequently uses names such as APT38, TraderTraitor, and Bluenoroff to describe related attack activity or associated threat clusters, but these names do not mean that all operations are carried out by the same team.
The U.S. government considers cybercrime associated with North Korea to be an important source of illicit funds, some of which may be used to support the North Korean regime and its weapons programs.
II. A Decade of Attacks: Major Incidents That Shook the World
2014: Sony Pictures Is Attacked
In November 2014, Sony Pictures suffered a large-scale cyberattack. The attackers infiltrated the company's internal network, stole a large volume of sensitive information, and used destructive malware to delete data, seriously disrupting the company's operations.
The leaked information included executives' internal emails, employees' personal information, unreleased film materials, corporate financial information, and trade secrets.
The incident made businesses around the world realize that cyberattacks can not only steal information but also directly disrupt normal business operations. The U.S. government later linked the attack to cyber activity associated with North Korea.
2016: $81 Million Stolen from Bangladesh Bank
This is one of the best-known incidents in the history of financial attacks associated with Lazarus.
The attackers first infiltrated Bangladesh Bank's internal systems and obtained relevant banking communication credentials. They then used the SWIFT international banking communications system to send fraudulent transfer instructions.
The attackers attempted to transfer approximately $951 million. Some transactions were stopped in time, but approximately $81 million was successfully transferred.
The incident exposed a major risk in the traditional financial system: even when a bank has a mature international payment system, a breach of internal terminals, identity credentials, and operational processes can still result in enormous losses.
2017: WannaCry Ransomware Sweeps the Globe
In May 2017, WannaCry ransomware spread rapidly to at least 150 countries worldwide, infecting approximately 300,000 computers.
The malware spread by exploiting a Windows vulnerability. Once a device was infected, it encrypted files and demanded a ransom in Bitcoin.
The UK's National Health Service (NHS) was severely affected. Hospital appointments, medical services, and internal systems were disrupted, and more than 19,000 appointments were canceled.
The United States, the United Kingdom, and other countries later publicly attributed the WannaCry attack to cyber activity associated with North Korea. The incident showed that the impact of cyberattacks was no longer limited to financial losses; they could even affect healthcare services and public infrastructure.
2022: Approximately $625 Million Stolen from the Ronin Bridge
In March 2022, the Ronin network behind the blockchain game Axie Infinity was attacked.
Through social engineering attacks targeting people associated with Sky Mavis, the attackers gained the permissions needed to control validator nodes and ultimately took control of enough of them.
The attackers then transferred approximately 173,600 ETH and 25.5 million USDC from the Ronin Bridge. At market prices at the time, the loss was approximately $625 million.
The project team did not discover the anomaly until several days later. In April 2022, the U.S. FBI officially attributed the attack to the Lazarus Group and related cyber activity associated with North Korea.
The incident exposed a core risk of cross-chain bridges: the blockchain itself may operate normally, but if the validation mechanism that controls cross-chain asset transfers is compromised, the entire bridging system can become a target.
2022: $100 Million Stolen from the Harmony Horizon Bridge
In June 2022, the Harmony project's Horizon cross-chain bridge was attacked, and approximately $100 million in crypto assets was stolen.
In January 2023, the U.S. FBI officially confirmed that the Lazarus Group was responsible for the theft. The attackers then used different addresses and privacy protocols to move the funds.
The FBI also disclosed that those involved had used privacy protocols such as RAILGUN to process some of the stolen ETH.
This shows that stealing the assets is only one part of an attack. Moving, splitting, and processing the stolen funds are equally important stages in the overall chain of criminal activity.
2023: A Series of Attacks on the Cryptocurrency Industry
In 2023, cyberattacks linked to Lazarus continued to target the cryptocurrency industry.
Atomic Wallet lost approximately $100 million, Alphapo approximately $60 million, CoinsPaid approximately $37 million, and Stake.com approximately $41 million.
The U.S. FBI successively released attribution information linking these incidents to cyberattacks associated with North Korea.
The targets were no longer limited to major exchanges, but gradually expanded to wallet providers, payment platforms, and the broader cryptocurrency ecosystem.
2025: Bybit Suffers the Theft of Approximately $1.5 Billion in Assets
This was one of the largest asset thefts in the history of the cryptocurrency industry.
On February 21, 2025, Bybit was attacked, and approximately $1.46 billion in ETH and related assets was transferred.
The most notable aspect of this attack is that the attackers did not simply crack the exchange's password. Instead, they exploited trust relationships in the supply chain and transaction-signing process.
According to information from Bybit's investigation, the attackers compromised the credentials and infrastructure of developers associated with Safe and manipulated the transaction-signing interface, causing signers to see transaction details that differed from the malicious transactions actually being executed.
Ultimately, the attackers gained control of one of Bybit's ETH cold wallets and transferred approximately $1.46 billion in assets.
On February 26, 2025, the U.S. FBI officially attributed the attack to cyber actors associated with North Korea and classified it as part of the TraderTraitor activity.
The FBI also disclosed that the attackers quickly converted some of the stolen assets into Bitcoin and other crypto assets, then distributed them across a large number of blockchain addresses.
This attack sounded an alarm for the entire industry: cold wallets are not absolutely secure, multisig mechanisms are not absolutely secure, and hardware wallets cannot prevent every malicious signature.
The real question is not just whether the private key has been leaked, but what transaction you are actually signing.
III. How Does Lazarus Carry Out Attacks?
A study of these historical incidents reveals several recurring attack patterns.
The first is social engineering.
Attackers may impersonate investment firms, recruiters, technical developers, project teams, or business partners, and contact targets through X, LinkedIn, Telegram, or email. After establishing trust, they may send purported work documents, investment materials, code tests, or meeting invitations.
Once a target downloads and runs a malicious file, attackers may go on to steal account credentials, gain access to the device, or even infiltrate the company's internal network.
The second is supply chain attacks.
Large exchanges and blockchain projects typically have multiple layers of security, making it difficult to attack their core systems directly. As a result, attackers may shift their focus to developers, third-party service providers, software vendors, and other partners with system access.
The Bybit incident is a typical example. The attackers took advantage of a breach in a third-party development environment and transaction interface to influence how signers assessed transaction details.
The third is on-chain fund transfers.
After stealing assets, attackers may split the funds across multiple addresses and use cross-chain swaps, different trading platforms, and privacy protocols to make tracing more difficult.
However, blockchains are not completely anonymous. Every transaction leaves a record. Even if attackers repeatedly change addresses, fund flows, transaction times, shared sources of funds, and relationships between addresses may still provide leads for investigators.
This is why the FBI, blockchain analytics companies, and trading platforms can use on-chain tracing to identify some stolen funds.
IV. What Impact Have These Attacks Had on the Global Cryptocurrency Industry?
First, they have shaken confidence in the security of financial institutions. The Bangladesh Bank incident demonstrated that traditional international banking payment systems can also be targeted by cyberattacks.
Second, security risks in cryptocurrency infrastructure have been reassessed. Incidents involving Ronin, Harmony, and others have led the entire industry to reconsider the security design of cross-chain bridges, multisig wallets, validator nodes, and smart contracts.
Third, exchanges' operating costs continue to rise. Cold wallet management, signature verification, third-party audits, on-chain monitoring, incident response, and insurance coverage all require greater investment.
Fourth, stolen assets may enter broader illicit financial networks. After being moved across multiple chains, converted, and laundered, stolen assets may affect trading platforms, DeFi protocols, and other ordinary users.
More concerning is the intersection of national cybersecurity issues and the cryptocurrency industry. This is no longer a matter of ordinary individual hacking, but a complex issue involving financial infrastructure, international security, and digital asset regulation.
V. How Can Ordinary Cryptocurrency Users Protect Themselves?
$BNB Ordinary investors do not need professional cybersecurity skills, but they must develop basic security habits.
Store large amounts of assets in a dedicated cold wallet whenever possible.
Never upload your recovery phrase or private keys to cloud storage or messaging apps.
Never share your recovery phrase, private keys, or signing authorization with anyone.
Do not casually install wallet extensions provided by strangers.
Do not use wallet software from unverified sources.
Check your wallet permissions regularly and revoke any that are no longer needed.
Do not blindly sign transactions you do not understand.
Before signing, verify the recipient address, contract address, and transaction details.
Be wary of unlimited token approvals.
Test large transactions with a small amount first.
For exchange accounts, you should also enable separate two-factor authentication, preferably using phishing-resistant methods such as hardware security keys. Set up a withdrawal address whitelist and enable login and withdrawal notifications.
It is important to emphasize that a hardware wallet can protect your private keys, but it cannot guarantee that a transaction you approve is safe. If you sign a malicious transaction, a hardware wallet can still become a gateway to losing your funds.
Exchanges, DeFi projects, and development teams should also separate private keys from business systems, divide multisig permissions, audit third-party software, apply the principle of least privilege, monitor unusual transactions, and implement emergency pause mechanisms.
VI. What Should Really Be Cause for Concern: The Targets of Cyberattacks Are Changing
Looking back at the history of attacks over the past decade or more, we can see a clear pattern of evolution.
From 2014 to 2017, attacks mainly targeted corporate systems, stealing data and deploying ransomware.
From 2016 to 2020, the scope of attacks expanded to banking systems, international payment networks, and financial institutions.
From 2018 to 2021, cryptocurrency exchanges, wallets, and related software gradually became key targets.
From 2022 to 2023, attacks further expanded to cross-chain bridges, DeFi, and blockchain infrastructure.
In 2025, supply chains, third-party development environments, and multisig transaction processes emerged as attack vectors of particular concern.
This does not mean that all attacks were carried out by the same people or using the same techniques. Rather, it shows that cyberthreat activity associated with Lazarus has come to cover an increasing range of financial infrastructure.
For the cryptocurrency industry, the security perimeter is changing.
In the past, people focused on whether private keys had been leaked or smart contracts had vulnerabilities. Now, we must also consider whether developers' computers are secure, whether third-party software is trustworthy, whether signing interfaces have been tampered with, and whether internal permissions are being abused.
The Lazarus Group's decade-plus history of attacks reveals a harsh reality: in the era of digital finance, the greatest risk may not be that systems are cracked, but that trust is exploited.
When billions of dollars in digital assets can be transferred in a short time, the entire industry must reconsider one question:
Are we building a secure digital financial system, or merely bringing the risks of the traditional financial world onto the blockchain?$BTC