How Lazarus Group and other North Korean linked cyber operators turned global financial institutions and cryptocurrency platforms into targets, and why international law enforcement struggles to bring them to justice.
I have been looking into the history of North Korean cyberattacks, particularly their involvement in cryptocurrency theft, and one question keeps coming to my mind.
How can a group of hackers steal billions of dollars from financial institutions and cryptocurrency exchanges operating across multiple countries, yet remain so difficult for international law enforcement agencies to physically arrest?
We are not talking about one isolated incident or a small group of inexperienced cybercriminals. We are looking at a decade long pattern of operations involving banks, payment networks, cryptocurrency exchanges, blockchain bridges, software developers and individual investors.
The name that repeatedly appears in these investigations is Lazarus Group, a North Korean-linked hacking organization.
Over the years, the methods have evolved. What started with attacks on traditional banking infrastructure gradually expanded into cryptocurrency exchanges, DeFi platforms and blockchain ecosystems.
But the most interesting part of this story is not simply how much money has been stolen. It is how difficult it has become to stop these operations, identify the actual individuals behind them and bring them before a court.
Let's look at the evidence.
1. A decade of cyberattacks: From traditional banks to cryptocurrency
2016 Bangladesh Bank Heist
Approximately $81 million was successfully stolen from Bangladesh Bank through fraudulent SWIFT payment instructions. Investigators linked the operation to North Korean hackers.
The attackers attempted to transfer approximately $951 million, but most of the attempted transfers were stopped.
2017 WannaCry Ransomware
A global ransomware attack affected hundreds of thousands of computers. Victims were locked out of their files and asked to pay Bitcoin to regain access.
The UK's National Health Service was among the affected organizations. The US Department of Justice subsequently connected the operation to North Korean hackers.
2018 BankIslami Pakistan
This incident is particularly relevant to Pakistan.
According to the US Department of Justice, approximately $6.1 million was stolen from BankIslami Pakistan through a coordinated ATM cash out operation known as FASTCash.
It demonstrates that these operations were not limited to Western financial institutions.
2022 Ronin Network
Approximately $625 million in cryptocurrency was stolen from the Ronin Network associated with Axie Infinity.
The FBI attributed the attack to Lazarus Group and APT38.
2022 Harmony Horizon Bridge
Another approximately $100 million was stolen from Harmony's Horizon Bridge. The FBI subsequently attributed the attack to Lazarus Group.
2023 Atomic Wallet, CoinsPaid and Alphapo
These incidents involved approximately:
Atomic Wallet: $100 million.
CoinsPaid: $37 million.
Alphapo: $60 million.
The FBI linked North Korean-affiliated actors to these incidents.
2024 WazirX, DMM Bitcoin and other attacks
Several major cryptocurrency platforms and projects suffered substantial losses:
DMM Bitcoin: approximately $308 million.
WazirX: approximately $235 million.
Upbit: approximately $50 million.
Radiant Capital: approximately $50 million.
Rain Management: approximately $16.13 million.
The governments of the United States, Japan and South Korea attributed several of these attacks to North Korean actors.
2025 Bybit Exchange Hack
This was another major turning point.
Approximately $1.5 billion in virtual assets was stolen from Bybit on February 21, 2025.
On February 26, the FBI officially attributed the attack to North Korea and identified the activity as TraderTraitor.
Investigators observed the stolen assets being moved across thousands of wallet addresses and multiple blockchain networks.
2026 Binance $6.3 Billion Incident
The latest reported incident has raised the stakes considerably.
On October 29, 2026, Binance suffered a reported cryptocurrency theft exceeding $6 billion.
On October 31, the FBI officially attributed the theft to North Korea and identified the operation as TraderTraitor.
According to the FBI, the attackers were converting stolen assets primarily into Ethereum, with further laundering expected through DeFi platforms and instant cryptocurrency swap services.
Binance also said it had arranged approximately $6.34 billion to cover the reported losses and was working with industry partners to freeze affected assets.
This is not just another exchange security incident. It demonstrates the scale of financial exposure that can result when sophisticated attackers compromise critical digital asset infrastructure.
👉 How do these hackers actually operate?
Something I find particularly concerning is that these operations do not always begin with a direct attack on an exchange's wallet infrastructure.
Sometimes, the entry point is an ordinary employee.
Their reported techniques include:
Social engineering: Attackers impersonate recruiters, employers, business partners or trusted contacts to gain access to employees and their devices.
Malware distribution: Malicious software and coding assignments can compromise computers and expose sensitive credentials.
Employee targeting: Individuals with access to internal systems, wallet management and transaction approvals become valuable targets.
Fake IT recruitment: North Korean linked operatives have reportedly used false identities to obtain remote employment at international companies.
Cryptocurrency laundering: Stolen assets are moved through multiple wallets, swapping services and blockchain networks to make investigations more complicated.
A September 2026 joint cybersecurity advisory described the WaterPlum campaign, which targeted IT professionals through fake job opportunities.
Between December 2025 and July 2026, the advisory reported at least 30,000 compromised devices across more than 100 countries, over 7,000 affected cryptocurrency wallets and approximately $10.71 million in stolen cryptocurrency.
Think about that for a moment.
A developer looking for a remote job could unknowingly become an entry point into an organization's wider technology infrastructure.
👉 The biggest question: Why can't international agencies arrest these hackers?
This is where the story becomes considerably more complicated.
We have agencies such as the FBI, Interpol, national police forces, intelligence services and specialist blockchain investigation companies.
They can investigate attacks, identify suspicious wallet movements, publish advisories, issue sanctions and even obtain criminal indictments.
But none of those actions automatically puts a suspect in handcuffs.
There are several reasons.
@ The hackers may be physically outside the investigating country's jurisdiction
According to the US Department of Justice's 2021 indictment, three North Korean military-linked hackers were associated with operations involving Lazarus Group and APT38.
The indictment alleged that some of these operatives had been stationed in countries including China and Russia.
This creates a major jurisdictional problem.
An American investigator may have evidence against a suspect, but if that individual is physically located in another country, the FBI cannot simply enter that country and make an arrest.
The investigating agency needs cooperation from the country where the suspect is located.
Without that cooperation, an arrest warrant may remain unexecuted for years.
@ North Korea is an extremely difficult jurisdiction for international law enforcement
Consider the practical situation.
If investigators identify a suspect who is believed to be operating from North Korea, how can they physically reach that individual?
They cannot simply send an arrest team into North Korean territory.
They need international legal cooperation, access to the suspect and an enforceable legal process.
Political relations, sanctions, diplomatic restrictions and the absence of practical cooperation can make these cases exceptionally difficult.
This is one reason why identifying a North Korean linked hacker does not necessarily mean that the person can be arrested.
@ Attribution is not the same as proving individual criminal responsibility
There is another important distinction.
An agency may conclude that a cyberattack is connected to Lazarus Group based on malware similarities, infrastructure, operational patterns, wallet movements and intelligence.
But proving that a particular individual personally carried out a specific crime requires a different level of evidence.
Investigators must establish:
Who actually controlled the compromised systems?
Who initiated or authorized the transactions?
Who controlled the wallets receiving the stolen funds?
What evidence connects the suspect to the operation?
Can that evidence be presented in court and withstand legal scrutiny?
A blockchain address does not automatically reveal the real-world identity of its owner.
Attribution can be technically convincing while still requiring additional evidence for a criminal prosecution.
@ Cryptocurrency moves faster than international legal procedures
This is probably one of the most serious challenges.
When stolen cryptocurrency moves through multiple wallets, exchanges, bridges and decentralized applications, investigators must follow the movement of assets across several jurisdictions.
They may need to contact different exchanges, financial intelligence units, regulators and law enforcement agencies.
Each country has its own laws, procedures and requirements for freezing or seizing assets.
By the time a formal request reaches another jurisdiction, the funds may have already moved several times.
A blockchain can provide a permanent transaction record, but it does not guarantee that investigators can immediately identify the people controlling the wallets.
@ The use of intermediaries makes investigations harder
North Korean-linked operations have also involved third country facilitators and money launderers.
These intermediaries may help with:
Converting cryptocurrency into traditional currencies.
Opening exchange accounts using false identities.
Moving funds through different financial networks.
Providing access to international financial services.
Concealing the connection between the original theft and the final recipient.
This creates another layer between the original hackers and the money.
Investigators may successfully identify a facilitator or freeze a wallet without immediately reaching the individuals who planned and executed the original attack.
@ International cooperation is not always fast or consistent
Imagine a theft involving an exchange in one country, a hacker operating from another, servers located in a third country and stolen cryptocurrency moving through platforms registered in several other jurisdictions.
Which country leads the investigation?
Who has authority to freeze the assets?
Which agency collects the evidence?
Who prosecutes the suspects?
These are not simple questions.
A 2026 analysis by the Center for Strategic and International Studies highlighted the difficulties created by fragmented international regulations, slow cross-border cooperation and the absence of a fully coordinated system for investigating, freezing and confiscating cryptocurrency related criminal proceeds.
The problem is not that international agencies do nothing. The problem is that their authority and practical reach are divided across national borders.
👉 Have international agencies actually identified and charged any of these hackers?
Yes. And this is an important distinction.
In September 2018, the US Department of Justice charged North Korean programmer Park Jin Hyok in connection with the alleged conspiracy involving the Bangladesh Bank theft, WannaCry and the Sony Pictures attack.
In February 2021, the DOJ announced additional charges against three North Korean military-linked programmers:
Park Jin Hyok
Jon Chang Hyok
Kim Il
The FBI has also published a wanted notice for Park Jin Hyok.
However, there is a major difference between charging someone and physically arresting them.
The FBI's wanted notice identifies Park as last known to be in North Korea.
This illustrates the central difficulty: investigators can identify suspects, build cases, obtain warrants and impose sanctions, but physically taking suspects into custody remains a separate challenge.
At the same time, international authorities have had greater success pursuing facilitators, fraudulent IT employment networks and money laundering intermediaries located outside North Korea.
In other words, the international response is not limited to trying to arrest the hackers themselves. It also targets the financial and operational networks that allow them to function.
👉 Why is freezing stolen cryptocurrency easier than arresting the people behind it?
This is a distinction that every cryptocurrency investor should understand.
When investigators identify stolen funds held by a centralized exchange, they may be able to request that the exchange freeze the relevant assets.
But when those assets are transferred to self custody wallets, decentralized protocols or services operating in jurisdictions with limited cooperation, the situation becomes much harder.
Consider three different scenarios:
__ Investigators identify a wallet and the funds move to a cooperative centralized exchange. There may be an opportunity to freeze the assets.
__ Funds move through multiple decentralized applications and cross-chain services. Tracing becomes more complicated.
__ Investigators identify the wallet movements but cannot establish who controls the destination addresses. They may understand where the money went without knowing who physically controls it.
This is why blockchain analytics companies, exchanges and law enforcement agencies increasingly need to work together.
The FBI's February 2025 Bybit alert and October 2026 Binance alert both demonstrate the importance of cooperation with exchanges, blockchain infrastructure operators and DeFi services.
👉 What should cryptocurrency exchanges learn from this decade?
I believe the industry needs to look beyond basic wallet security.
The biggest weaknesses may exist in the systems surrounding those wallets.
Here are five areas that deserve serious attention:
✅ Independent transaction approvals
Large withdrawals should require multiple independent approvals rather than relying on a single compromised system or employee.
✅ Employee and developer security
Background verification, device security, restricted permissions and careful examination of external code are essential.
✅ Real-time transaction monitoring
Unusual withdrawal patterns, suspicious wallet activity and unexpected changes in transaction behaviour should trigger immediate alerts.
✅ Emergency response mechanisms
Exchanges should maintain clear procedures for suspending withdrawals, coordinating with blockchain operators and requesting asset freezes.
✅ Independent security audits
Security reviews should examine the entire transaction signing infrastructure, internal permissions, software supply chains and third-party integrations.
✅ My final observation: The real challenge is accountability
After examining these incidents, I don't think the cryptocurrency industry's biggest security question is simply whether another exchange will be hacked.
That risk will always exist.
The more important question is whether the industry and international law enforcement agencies can work together quickly enough to identify the attackers, disrupt their financial networks, recover stolen assets and eventually bring the responsible individuals before a court.
The history from Bangladesh Bank in 2016 to Bybit in 2025 and the reported Binance incident in October 2026 shows how dramatically the threat landscape has changed.
But there is a difference between tracing a transaction, identifying a hacking group, proving an individual's criminal responsibility and physically arresting that person.
These are four separate challenges.
And perhaps that is the most uncomfortable reality of modern cybercrime: the world can see billions of dollars moving across a transparent blockchain, yet still struggle to put the people responsible behind bars.
For cryptocurrency investors, this should be a reminder that transparency, decentralization and advanced technology do not automatically guarantee security.
The industry needs stronger internal controls, better international cooperation and real accountability.Because recovering stolen money is important, but preventing the next attack is even more important.
#BinanceToResumePhaseOneOfWithdrawals #BinanceHadAlreadyCovered$6BofHackLoss #FBIConfirmsNorthKoreaIsResponsibleForBinanceCryptoHack #BinanceSAFUFundTransferCompleted7499BTC #BinanceRecovery90% of stolen assets
