The United States Department of Justice has charged three North Korean nationals with allegedly taking part in a vast international cybercrime operation.
The case involves cryptocurrency thefts, cyberattacks, and extortion attempts valued at more than $1.3 billion.
But who are these people, and what do we really know about the groups associated with these operations?
When we talk about security in the cryptocurrency market, one name frequently comes up in investigations into major cyberattacks:
Lazarus Group.
This group is associated by authorities and cybersecurity researchers with digital espionage operations, attacks on financial institutions, and theft of digital assets.
In February 2021, the United States Department of Justice (DOJ) announced a federal indictment against three North Korean citizens, allegedly linked to the country's military intelligence units.
The indictment attracted international attention not only because of the names involved, but also because of the scale of the operations described.
Let's look at the facts without confusing allegations with convictions.
1. Who are the three individuals identified by the Department of Justice?
The three names listed in the 2021 federal indictment are:
Jon Chang Hyok
Kim Il
Park Jin Hyok
According to the U.S. Department of Justice, the three were members of units within the Reconnaissance General Bureau (RGB), a North Korean military intelligence agency.
The indictment alleges that these units took part in cybercrime operations aimed at hacking computer systems, stealing information, obtaining money, and moving cryptocurrency.
The document also links the alleged participants to groups known in the cybersecurity sector as Lazarus Group and APT38.
It is important to emphasize that these are allegations made by U.S. authorities. The existence of a formal indictment does not mean that the individuals have been convicted.
2. What is the Lazarus Group?
Lazarus Group is the name used by cybersecurity researchers to identify a collection of cyberattack activities and operations associated with North Korea.
The group is often linked to attacks on companies, financial institutions, and organizations in various sectors.
Among the activities attributed to them are:
Hacking networks and computer systems;
Stealing information and credentials;
Attacks on financial institutions;
Stealing cryptocurrencies;
Using malicious software;
Laundering and moving stolen funds.
The Lazarus Group is also associated with other names used by different investigative entities, such as APT38.
However, the names used by companies and authorities do not always represent exactly the same operational structure.
Therefore, it is more accurate to talk about associated groups or activities than to assume that all the names identify a single, clearly defined team.
3. More than $1.3 billion: what does the indictment say?
According to the U.S. Department of Justice, the conspiracy described in the indictment involved attempts to steal and extort more than $1.3 billion in cash and cryptocurrency from financial institutions and companies.
The document mentions different types of operations, including:
Cyberattacks against companies;
Attempts to steal funds from financial institutions;
Creating and distributing malicious cryptocurrency-related applications;
Developing and fraudulently promoting a blockchain platform;
Extortion campaigns and ransomware attacks.
The indictment also refers to earlier operations, including the 2014 attack on Sony Pictures and the 2017 WannaCry ransomware attack.
An important distinction: the $1.3 billion represents the amount that authorities said was targeted in attempted theft or extortion as part of the conspiracy described.
It should not be presented as an amount stolen in full by the three individuals.
4. Is the FBI still tracking the funds?
Yes. A concrete example emerged in August 2023.
In an official statement, the FBI said it had tracked approximately 1,580 $BTC then valued at more than $40 million, associated with North Korean actors linked to TraderTraitor.
The FBI warned that these actors might try to convert the bitcoins into cash or other assets.
The investigation linked these funds to several previous attacks, including:
Alphapo: approximately $60 million in digital assets;
CoinsPaid: approximately $37 million;
Atomic Wallet: approximately $100 million.
These figures correspond to the FBI's estimates for the respective thefts.
The agency asked companies in the sector to monitor the identified wallets and exercise caution with transactions involving those addresses.
This episode demonstrates one of the most interesting features of blockchain technology: although users may not know the real identity behind a wallet, the movement of assets on public networks can be analyzed and tracked.
5. How can stolen funds be traced?
One misconception about cryptocurrencies is that all transactions are completely anonymous.
In reality, networks such as #Bitcoin and #Ethereum keep public records of transactions.
This means that specialist investigators can track:
The address the funds came from;
The addresses that received the assets;
The amounts transferred;
The timing of the transactions;
Connections between different wallets.
Blockchain analytics companies use this information to identify patterns and possible links between operations.
But there is an important limitation: tracking a wallet does not necessarily mean knowing the identity of the person who controls it.
Investigators may find technical links between transactions without being able to immediately prove who received the funds or who benefited from them.
That is why blockchain analysis is often combined with intelligence, police investigations, and cooperation between companies.
6. Why are these operations a concern for the crypto market?
Attacks attributed to groups associated with North Korea raise concerns across the entire sector.
An exchange may invest millions in security and still remain exposed to risks involving employees, compromised devices, internal systems, and social engineering.
Furthermore, when large amounts of cryptocurrency are stolen, the effects can extend beyond the affected platform.
This can lead to trust issues, put pressure on security measures, and make it difficult to identify or freeze the assets.
The challenge is not just to prevent the attack. It is also necessary to detect suspicious movements, cooperate with other entities, and reduce harm to users.
7. What can we learn from these cases?
For people who use exchanges or invest in cryptocurrencies, these incidents offer some practical lessons:
Protect your accounts: use two-factor authentication and avoid reusing passwords.
Be wary of unexpected messages: phishing attacks can impersonate well-known companies to steal credentials.
Protect your devices: keep systems up to date and avoid installing applications from unknown sources.
Don't share your recovery phrase: no legitimate exchange needs your seed phrase to help you.
Understand the risks of centralized platforms: keeping assets on an exchange can be convenient, but it means trusting its security and management systems.
Conclusion: allegations, investigations, and a threat that continues to be monitored
The case of the three North Korean citizens shows the scale that international cybercrime investigations can reach.
The United States Department of Justice filed formal charges against Jon Chang Hyok, Kim Il, and Park Jin Hyok, alleging that they took part in an international conspiracy involving cyberattacks and financial crimes.
The FBI, in turn, continues to release information about digital funds associated with operations attributed to North Korean actors.
But it is essential to be precise: individuals named in an indictment should not be treated as guilty without a conviction, and attack attributions should be presented with their sources and limitations.
In the crypto market, security does not depend on technology alone.
It also depends on the ability to investigate, cooperate, and protect users.
And you, had you heard of the Lazarus Group?
Do you think exchanges and cryptocurrency companies are sufficiently prepared to deal with attacks on this scale?
Share your thoughts in the comments. Information is power!
Official sources for further reading
U.S. Department of Justice (February 17, 2021): Indictment of three North Korean citizens for alleged involvement in global cybercrime operations
FBI (August 22, 2023): Identification of Bitcoin funds associated with North Korean actors
FBI (September 6, 2023): Attribution of the $41 million theft from Stake.com to the Lazarus Group
U.S. Department of Justice (September 6, 2018): Initial indictment against Park Jin Hyok