Crypto’s most notorious hackers, the Lazarus Group, holds more bitcoin BTC$91,817.11 than Tesla — funds it stole, rather than bought. And despite efforts to tamp down on their exploits, the group continues to target legitimate exchanges and find esoteric vulnerabilities it can use to continue building the Democratic People’s Republic of Korea’s (DPRK) weapons of mass destruction program.

The North Korean hacking group stole $1.3 billion in cryptocurrencies in 2024. By mid-2025, it had already stolen north of $2 billion, and was on track to break its record for total funds stolen. Beyond the thefts themselves, Lazarus has taken advantage of privacy tools like mixers to launder its funds and limit recoveries by governments or its victims.

Part of the crypto movement’s appeal is the relatively easy transfer of funds, which governments cannot interfere with — but as with any other tool, this means that whatever advantages law-abiding users gain also work for malicious actors. Lazarus’ growing sophistication in targeting exchanges and other platforms, alongside the sheer difficulty the crypto industry has traditionally had in securing every last vulnerability, means that this U.S. government-sanctioned group has continued to enjoy high-profile hacks.

In 2025 alone, Lazarus has been tied to the $1.5 billion hack of Bybit in February and the $36 million hack of Upbit in November, two of the higher-profile hacks this year. Beyond the growing sophistication of its hacks — the Bybit hack, for example, saw Lazarus compromise a developer machine to manipulate a multisignature security solution’s user interface to essentially trick a user — Lazarus continues to take advantage of crypto-native tools to move its funds.

The group has in the past used mixers like Tornado Cash to move its funds and make it more difficult for governments or investigators to trace. THORChain became a key tool for Lazarus in laundering the funds stolen from Bybit.

Lazarus’ actions have drawn government attention in the past. The U.S. government briefly sanctioned Tornado Cash and secured a conviction against one of its developers, and had previously recovered other funds stolen by Lazarus. The more recent hacks continue to draw international attention, marking yet another reason the crypto industry needs to take these types of security concerns seriously.