lazarus

The preliminary investigation report on the security incident released by Binance on October 29 shows that the attack began with a fake recruitment. According to the report, in September, a Binance software engineer was contacted by someone impersonating a project director through a legitimate job platform. After undergoing a fake HR video interview and a fake CEO second interview, the engineer was asked to download a homework code repository on their work computer, which contained a zero-day Trojan that bypassed endpoint protection. The attackers then used the compromised device and an internal AI tool to control the computers of two other wallet engineers, stealing deployment credentials, and ultimately executed a malicious script on October 29 to transfer approximately $6.3 billion. Binance stated that it has frozen or intercepted about $2.85 billion and has compensated 98% of the affected assets.This method is almost identical to the March 2022 theft of the Axie Infinity sidechain Ronin cross-chain bridge. At that time, the North Korean hacker group Lazarus contacted a senior engineer at developer Sky Mavis through LinkedIn for a high-paying position. After several rounds of interviews, they sent an offer file containing a Trojan, which allowed them to control the private keys of the validation nodes, stealing approximately $625 million. The Binance report also noted that this year, 57 suspected cyberattacks related to North Korea have been detected and intercepted, with methods including fake interviews, malware disguised as popular development tools, tampered software packages, and browser plugins, among others.

According to the Korean Central News Agency, North Korea mentioned in its denial of involvement in the theft related to Binance that last year the United States linked the hacking incident at the cryptocurrency exchange platform Bybit to North Korea. The Korean Central News Agency stated that the United States misled international public opinion, creating the illusion that cyber fraud occurring around the world was all orchestrated by North Korea, which is a serious political provocation against North Korea. North Korea firmly opposes any attempts to politicize cyber issues and use them as a means of interfering in the internal affairs of other countries, stating that this is the consistent policy position of the Democratic People's Republic of Korea government.The Korean Central News Agency also stated that it is necessary for the international community to reflect again on the fact that the current U.S. government announced the confiscation of illegally stolen cryptocurrency assets, acting as a national strategic reserve as soon as it took office last year. The Korean Central News Agency suggested that if the stolen massive cryptocurrency funds were to be recovered, one might discover clues related to the hacking incident. On February 21, 2025, Bybit experienced a large-scale theft incident, with a total value of approximately $1.5 billion. The U.S. FBI and several on-chain analysis agencies subsequently attributed the incident to the North Korean Lazarus Group (TraderTraitor).

According to on-chain analyst Darkfost, with the occurrence of the recent Binance attack, the total amount of funds stolen by the North Korean hacker organization Lazarus Group has reached 11.87 billion dollars.Based on 2025 data, this amount is equivalent to 45% of North Korea's GDP and 35% of its gross national income, which illustrates the astonishing scale.However, during multiple money laundering processes, some funds have also been lost. The recent Binance attack is the most profitable event for this North Korean hacker organization.

Crypto KOL Kuai Dong (entered the industry in 2016) stated that on-chain tracker ZachXBT speculated that the party responsible for the attack on Binance and the theft of $5.875 billion is the Lazarus Group, which is under the Reconnaissance General Bureau of the Korean People's Army.Kuai Dong also listed past theft results related to this organization, including approximately $300 million from Japan's DMM exchange, about $230 million from India's WazirX exchange, around $1.5 billion from Bybit, approximately $292 million from the on-chain protocol Kelp DAO, and about $380 million from Bitget.He also mentioned that Binance has recovered about half of the assets, but the recovery of Bitcoin, Ethereum, and others is more challenging, and stated that the hackers' ultimate goal is to funnel the assets into North Korea. ZachXBT responded in related discussions that this incident is likely related to the North Korean Lazarus Group. Public information shows that around October 30, there was a massive outflow of assets from Binance's hot wallets, with cross-chain statistics estimating between $5.5 billion to $6.2 billion. Zhao Changpeng stated that it indeed looked like they were hacked and mentioned that the actual net loss might be slightly above $1 billion, but they would cover the full amount.

"On-Chain Detective" ZachXBT stated that he once disguised himself as a client to infiltrate a criminal gang suspected of laundering money for the North Korean-backed hacker organization Lazarus Group, and assisted in freezing funds related to the 2025 Bybit attack incident.ZachXBT indicated that after Bybit was attacked for $1.5 billion in February 2025, he discovered over 15 accounts seeking help with transactions related to the stolen funds in public Telegram and Discord groups. He then contacted a Telegram user using the alias "Jimmy Green" and built trust through multiple transactions.According to his disclosure, on March 6, 2025, he transferred $3.497 million USDC to an Ethereum address for exchanging USDC with TRON chain USDT. The Gas funds for that address trace back to the Bybit attack funds and have been publicly marked as a Bybit attack blacklist address.ZachXBT stated that in subsequent communications, the other party revealed that their team had participated in handling the stolen funds from Bybit and disclosed in advance that the funds would be transferred on chains such as Solana. By matching transaction times, amounts, and on-chain data, he discovered a wallet cluster involving over $12 million of Bybit attack funds, with funding paths including BTC→ETH→SOL→TRON and others, among which approximately 442,000 USDT had been frozen by Tether. The gang also attempted to launder money through Uniswap liquidity pools and low liquidity tokens.In addition, the other party revealed that they had helped other clients handle approximately $3 million in scam proceeds, and ZachXBT tracked the related funds flowing to sanctioned Huione Guarantee-related wallets.ZachXBT disclosed that during this investigation, he initially invested $3.497 million and bore about 5% loss risk for each transaction. The intelligence obtained was promptly provided to relevant investigative agencies and law enforcement. Since 2022, he has assisted in freezing over $75 million related to North Korea-related incidents.

According to Shield's monitoring, NEAR Intents attackers have transferred the stolen funds to Kucoin and bridged them to BTC. The attacker's address has interacted with an address marked as North Korea's LazarusGroup (0x098B7...E2f96).

According to on-chain detective Specter, by tracking on-chain fund flows, the North Korean hacker organization Lazarus Group may be the behind-the-scenes attacker of the Bitget theft incident. This incident is linked to the AFX attack that occurred in July this year, which resulted in losses of approximately 24 million dollars and was attributed to TraderTraitor associated with Lazarus Group.The stolen XRP from Bitget, after cross-chain transfer, can be directly linked to the stolen funds in the AFX attack.

According to monitoring by Lookonchain, the hacker organization Lazarus Group sold 911 ETH (2.28 million USD) at an average price of 2499 USD in the past 2 hours.

According to Lookonchain monitoring, the Lazarus Group hackers transferred 244.148 Bitcoins, worth 19.42 million dollars.

According to on-chain analyst Ai Yi's monitoring, the hacker group Lazarus Group transferred 262.2 BTC to a new address 2 hours ago, worth $16.64 million, possibly planning to launder it.Currently, the organization still holds assets worth over $73.06 million on-chain, mainly including BTC, USDT, and ETH.

Cryptocurrency exchange Bybit has filed a civil lawsuit against the Democratic People's Republic of Korea, its intelligence agency Reconnaissance General Bureau (RGB), and the state-sanctioned hacking organization Lazarus Group, involving a $1.5 billion hacking incident.A U.S. federal court has issued a preliminary injunction prohibiting the transfer or dissipation of identified assets related to the case during the litigation period.

According to Lookonchain monitoring, the Lazarus Group hackers transferred 121.5 BTC ($7.74 million) one hour ago.

According to Bitcoin.com, U.S. Senator Cynthia Lummis is pushing for the CLARITY Act to complete Senate voting before Congress goes into recess. Article 303 of the bill grants the Treasury Department the authority to impose targeted sanctions on digital assets in foreign jurisdictions, while Article 305 allows exchanges to freeze suspicious transactions for up to 180 days.On-chain data shows that North Korea's Lazarus Group stole approximately $643 million in the first half of 2026, accounting for two-thirds of the total amount stolen in cryptocurrency globally during the same period ($972 million), which includes a $285 million attack on Drift Protocol in April and a $292 million attack on the KelpDAO cross-chain bridge. The organization has accumulated a total theft of $6.75 billion since 2019.Currently, Galaxy Research has lowered the probability of the CLARITY Act passing in 2026 to 30%. The bill still requires 60 votes to advance, meaning at least 7 Democratic senators need to cross party lines to support it.

According to Cryptopolitan, cybersecurity analysts have discovered a new type of fileless remote access trojan (RAT) named RemotePE. It is believed that the cybercrime organization Lazarus Group, associated with North Korea, is using this trojan to attack banks and cryptocurrency companies. The trojan operates entirely in memory, making it difficult for traditional antivirus and forensic tools to detect. Attackers impersonate trading company employees via Telegram, using forged Calendly and Picktime links for social engineering attacks. The malware is loaded in a three-stage chain through DPAPILoader, RemotePELoader, and RemotePE, with the entire process avoiding contact with the file system, utilizing process hollowing, anti-analysis checks, and encrypted C2 communication to evade detection.This malware was first discovered in September 2025. In the first four months of 2026, the Lazarus organization has stolen approximately $577 million in cryptocurrency assets, accounting for 76% of the total global cryptocurrency theft. Since 2017, the organization has accumulated a total theft amount of $6 billion.

According to research by OpenSourceMalware, the North Korean hacker group Lazarus has adopted new techniques in malicious activities targeting developers, such as "infectious interviews" and "TaskJacker," hiding the second-stage loader in the pre-commit scripts of Git Hooks. "Infectious interviews" is a series of attack activities where the organization lures developers into cloning malicious code repositories by faking recruitment processes in the cryptocurrency/DeFi field, ultimately stealing crypto assets and credentials.Researchers recommend that developers who are asked to clone code repositories as part of the interview process should be wary of such risks and preferably run in an isolated environment to avoid mounting personal browser configurations, SSH keys, and cryptocurrency wallets.

According to CoinDesk, monitoring by CertiK reveals that the Lazarus Group is conducting an attack operation named Mach-O Man targeting executives in the fintech and cryptocurrency industries. This operation utilizes ClickFix social engineering techniques, sending fake online meeting invitations to lure victims into pasting repair commands on their Mac terminals, thereby gaining access to company and financial systems.CertiK researcher Natalie Newson stated that the Lazarus Group has stolen over $500 million through attacks on Drift and KelpDAO in the past two weeks. Mach-O Man is a modular macOS malware toolkit developed by the Chollima division of the Lazarus Group, capable of automatically deleting itself after use to evade detection.Additionally, attackers have implemented this attack by hijacking DeFi project domain names and replacing them with fake Cloudflare messages.

The report "2025 Cyber Threat Trends and 2026 Security Outlook" released by AhnLab shows that the North Korean-backed hacker group Lazarus has been named the most frequently in the past 12 months, primarily using "spear phishing" to carry out attacks, often disguising themselves as seminar invitations, interview requests, and other emails to lure targets into opening attachments. The report states that Lazarus is considered the main suspect in several major attacks, including the Bybit hacking incident on February 21 this year (resulting in a loss of $1.4 billion) and the recent $30 million vulnerability attack on the South Korean exchange Upbit.AhnLab indicates that to enhance security, companies need to establish a multi-layered defense system, including regular security audits, timely patch updates, and strengthening employee education. The company also recommends that individual users employ multi-factor authentication, handle unknown links and attachments with caution, avoid excessive exposure of personal information, and only download content from official channels. AhnLab points out that with the widespread use of AI applications, attackers will find it easier to generate indistinguishable phishing emails, spoofed pages, and deepfake content, and related threats may further complicate in the future. (Cointelegraph)

Regarding Upbit's incident of approximately 44.5 billion KRW (about 36 million USD) in cryptocurrency being stolen, CryptoQuant CEO Ki Young Ju stated today that the attack method disclosed by Upbit is "almost impossible for an ordinary hacker to accomplish."Upbit previously mentioned that the attackers might have "inferred the private keys" by analyzing the patterns of user wallet addresses. Ki Young Ju bluntly remarked that the difficulty of such attack techniques is extremely high, and if this is true, "I suspect that no hacker organization other than North Korea's Lazarus could achieve this."

According to Yonhap News Agency, South Korean virtual asset exchange Upbit has suffered a hacker attack, resulting in the theft of virtual assets worth 44.5 billion won. Currently, the North Korean reconnaissance agency's hacker organization Lazarus Group is highly suspected to be behind this incident.Local time, Yonhap News Agency learned from the information and communication technology (ICT) industry and relevant South Korean government departments that, given the significant suspicion surrounding the hacker organization Lazarus Group under the North Korean reconnaissance agency, authorities are conducting on-site inspections of Upbit. This hacker organization was previously implicated in the theft of 58 billion won worth of Ethereum from Upbit in 2019. A government official stated, "This attack is unlikely to have targeted the server; it is more probable that the administrator account was stolen, or that the attacker disguised themselves as an administrator to transfer funds." He also mentioned, "Based on the information currently available, the hackers used this method six years ago, so it is speculated that the same method was employed this time."