The openness and freedom of the encrypted world always comes at a silent cost for someone.

Written by: Liu Honglin

In March 2024, an employee working at the Japanese wallet software company Ginco encountered a "recruiter" on LinkedIn. The recruiter sent him an onboarding test that required him to process a piece of Python code.

Recruitment websites, code hosting platforms, and technical tests are all familiar to programmers looking for jobs. However, according to investigations later released by the FBI and Japan's National Police Agency, this encounter allowed the attacker to infiltrate the employee's device.

Two months later, the attacker impersonated this employee using the stolen login session to access the company's communication system, most likely altering a legitimate transaction request from the client DMM Bitcoin.

Ultimately, 4,502.9 bitcoins were lost, valued at approximately $308 million at the time of the event. The person who obtained this money did not appear as a masked robber. Instead, he entered your daily life disguised as someone who could possibly help you find a job.

Illustration of the DMM Case Action Path

This also explains why, in discussions today about North Korean hackers, merely stating that their "technology is impressive" is no longer sufficient.

On October 31, 2026, the FBI attributed the theft of over $6 billion in virtual assets from Binance to North Korea, using the operational label TraderTraitor. Binance's earlier preliminary investigation mentioned that a developer's computer might have been compromised, allowing the attacker to gain access to service containers and submit unauthorized withdrawal transactions; the platform stated that no evidence of wallet private key leaks had been found at that time.

The investigation is still ongoing.

From a recruitment test to the exchange's wallets, employee devices, and vendor systems, North Korea-related cyber operations have continuously infiltrated the workflow of the cryptocurrency industry.

The name most familiar to the outside world is Lazarus, the Lazarus Group. But behind this name lies a group of individuals, and how did they transform assets on the screen into cash that can be used in reality?

How Much of the North Korean Intelligence System Can Be Seen Behind Lazarus

Lazarus easily conjures the image of an independent secret squad: with a fixed leader, clear members, and a hidden war room. However, the materials we can read mostly come from sanction documents, judicial investigations, victim retrospectives, and tracking by security companies.

This name is primarily a label used by outsiders to identify cyber activities, and it may not genuinely be a formal department name within North Korea.

In 2019, the U.S. Treasury sanctioned Lazarus, Bluenoroff, and Andariel, asserting that they were controlled by North Korea's Reconnaissance General Bureau. The Reconnaissance General Bureau is a critical intelligence agency in North Korea, abbreviated in English as RGB. That announcement also linked Lazarus to the 110 Research Center under the third bureau of the Reconnaissance General Bureau. Another sanctions announcement from 2023 continued to disclose connections between the Technical Reconnaissance Bureau, the 110 Research Center, and Pyongyang Automation University: some institutions are responsible for cyber operations and tool development, while specialized schools train technicians who later enter related units.

By gathering these materials, we can see a personnel supply chain with training and organizational support. As for the common assertions online about how "certain agencies have this many people" or "all hackers are coordinated by a certain department," the publicly available evidence is far from complete.

Instead of drawing what seems like an accurate secret organizational structure, it’s better to look downward along the individuals that have surfaced.

Park Jin-hyuk is one of them.

In 2018, the U.S. Department of Justice announced criminal charges against him, stating that he had worked for Chosun Expo Joint Venture. This company, which presents itself as a technical enterprise, was identified by U.S. officials as a front for the North Korean government, involved in supporting malicious cyber operations. The indictment published in 2021 added two North Korean programmers, labeling the three as members of a unit related to the Reconnaissance General Bureau.

Wanted poster for Park Jin-hyuk from 2018. Image source: FBI/Wikimedia Commons archive

These are allegations made by the prosecution, but they provide more specific clues than the term "genius hacker": a person may have a company identity, a work email, and external technical business, while simultaneously being accused of participating in state-sponsored cyber operations.

What clients encounter may only be a programmer capable of taking on projects and writing code. According to prosecution materials, Park Jin-hyuk and his companions indeed did programming work for overseas paying clients; these external business dealings existed concurrently with the cyber attacks they are accused of participating in.

In the Park Jin-hyuk case, the U.S. referred to the team he was part of as "Lazarus"; in the DMM and Bybit cases, the FBI used the name TraderTraitor. Along with commonly mentioned names like Bluenoroff, Andariel, and APT38 (with APT being an abbreviation for "Advanced Persistent Threat"), readers may easily think that there’s a corresponding department and a fixed group of members behind each name.

However, this cyber force's mission has never been limited to stealing coins.

The destructive attack on Sony Pictures in 2014, the theft from the Bangladesh Central Bank in 2016, and the spread of the WannaCry ransomware in 2017 all entered U.S. accusations and attribution documents against North Korean-linked individuals. Political retaliation, destruction, intelligence gathering, and fundraising appeared intertwined across different cases. The cryptocurrency industry later became a significant target, aligning with one of the most easily monetizable needs: acquiring funds.

From Bank Transfers to Huge Assets in Cross-Chain Bridges

The Bangladesh Central Bank case already revealed the financial goals of these types of operations. According to accusations disclosed by the U.S. Department of Justice, the attackers infiltrated the bank's networks and sent false interbank payment instructions, ultimately resulting in about $81 million being stolen.

However, traditional funding theft requires the money to enter traditional banking systems, going through accounts, payees, and subsequent transfers before it can be truly taken.

Cryptocurrency assets offer a radically different possibility. If attackers control permissions to issue valid transactions, they can quickly transfer assets to addresses they control. Of course, the coins still need to be converted into fiat currencies and materials, which will ultimately face real-world trading partners.

Yet, the step of "first transferring the assets away" can entirely bypass traditional financial institutions, which is the freedom most revered in the cryptocurrency world represented by Bitcoin.

North Korean-linked attackers entered this market using an early method that required a good deal of patience: creating a seemingly normal cryptocurrency trading software and waiting for practitioners to install it themselves.

In 2021, the U.S. Cybersecurity and Infrastructure Security Agency, FBI, and Treasury jointly disclosed the AppleJeus malware activity.

AppleJeus is the name assigned by security agencies to this type of software. Attackers approached targets through seemingly legitimate business websites and trading applications, enticing users looking for trading tools to unwittingly install malicious programs on their computers. For those managing trading accounts, wallets, or company technical systems, a single software installation could bring risks from their personal devices next to the company's assets.

By 2022, a larger financial pool became a target: cross-chain bridges.

Cross-chain bridges help users move assets between different blockchains. Some bridges lock assets on one side and then provide corresponding receipts or assets on the other side. Users can thus utilize funds across chains, and the bridge itself accumulates a large amount of assets to support these receipts. For attackers, finding the necessary permission to approve withdrawals opened an opportunity to access significant sums of money that many users depend on.

In March 2022, the Ronin network, serving the blockchain game Axie Infinity, was hacked, resulting in the loss of 173,600 Ether and 25.5 million USDC.

The most noteworthy aspect of this breach was that the attackers obtained the signature permissions from five of nine validators. The system originally required a certain number of validator approvals to execute withdrawals; once the attackers had enough valid signatures, their forged withdrawal requests could surpass that threshold. The FBI later attributed the case to Lazarus and the APT38-related actors.

Discussions about blockchain security often start with algorithms and contract codes. The Ronin case reminds us to also look at who manages the signatures, where permissions are actually centralized, and whether there are independent defenses between the layers of approval. Protocols can strictly enforce rules, but the permissions behind the rules might have already been compromised.

In the same year, Harmony's Horizon cross-chain bridge experienced approximately $100 million in asset theft. In January 2023, the FBI publicly attributed the case to North Korea-related Lazarus organizations. Subsequent cases involving Atomic Wallet, Alphapo, CoinsPaid, and others also appeared in FBI attribution announcements.

The change in targets is quite significant. The attackers no longer targeted just a single exchange, but rather the key entry points for cryptocurrency assets: where they are stored, who approves transfers, which software is responsible for presenting transactions, and which service providers have the chance to handle critical operations. Whoever holds those positions in their work is likely to be chosen.

DMM and Bybit: First Approach Those with Permissions

Returning to the Ginco employee mentioned at the beginning of the article, he was not an employee of DMM Bitcoin but positioned within the service chain relied upon by DMM's fund management. The attackers approached him under the pretense of recruitment, acquiring not just an ordinary social account but an opportunity to advance within the wallet service provider.

According to the joint announcement from Japan and the U.S., after the interaction in March 2024, the attackers impersonated the employee using session information in mid-May to enter Ginco's communication system. By late May, they likely manipulated a DMM employee's legitimate transaction request via this entry. Several months were spent turning what seemed like a trivial recruitment contact into a legitimate action that could transfer assets.

This is far more complex than simply "the employee clicked on a phishing link." The recruiter needed to make the test appear credible, understand the work system after infiltrating, find the connections related to customer transactions, and allow the erroneous request to pass. An engineer's technical capabilities do not automatically substitute for independent verification of recruitment identity, device isolation, and transaction requests.

On February 21, 2025, approximately $1.5 billion in virtual assets were stolen from Bybit, thrusting this issue into the spotlight of cold wallets.

Cold wallets usually refer to arrangements that isolate key signature materials from daily connected environments, leading many to believe that simply storing coins in a cold wallet makes it very difficult for attackers to reach them.

However, cold wallets' funds need to be transferred out at some point. At that time, the signers need to view transactions, assess them, and then execute signatures. In the Bybit incident, the attackers precisely targeted this transition process between people and systems.

According to Bybit's public investigation progress and Sygnia's technical review, the attack involved the compromise of infrastructure related to the Safe wallet, with malicious code entering the web interface used by the signers. The signers thought they were approving normal operations, but the transactions they actually signed changed the wallet control logic, leading to asset transfers. The FBI attributed the theft to North Korea on the 26th of that month, referring to it as TraderTraitor.

Illustration of Signature Deception in the Bybit Case

There is a crucial distinction that is easily overlooked: the signatures are authentic, but the signers were misled about what they were signing. Properly safeguarding private keys does not guarantee that every transaction they sign reflects the signer’s true intention. If several individuals rely on a tampered display interface, multiple approvals may still duplicate the same error.

In the situation surrounding the Binance case at the end of October 2026, Binance's preliminary announcement pointed to a possible entry through a developer's computer and stated that no evidence of wallet private key leaks had been found. The FBI announcement attributed it to North Korea, but did not publicly disclose the complete path of the intrusion.

However, by linking DMM, Bybit, and this latest clue together, we can already identify a concerning commonality: a company may focus heavily on its wallets and contracts, but attackers can enter through the employees, software pages, and operational permissions it relies on. Where funds ultimately reside does not necessarily dictate where the initial intrusion occurred.

More and More Identities of Remote Colleagues Emerge

Fake recruitment serves to entice target employees to open what attackers have provided. Another pathway that has been repeatedly disclosed is that attackers themselves entered the recruitment process, seeking to be hired by companies.

In June 2025, the U.S. Department of Justice announced a round of joint actions against networks of North Korean remote technical personnel. Relevant cases disclosed that some individuals applied for jobs using stolen or fabricated identities, with helpers inside the U.S. receiving computers sent by employers and allowing foreign personnel to connect remotely. The locations where these computers were centralized and maintained in operation were referred to as "laptop farms."

"Laptop Farm" in the Chapman case: centralized storage for employer's computers. Image source: U.S. Department of Justice, publicly released on July 24, 2025.

From the employer's perspective, laptops were sent to local addresses, and connections were routed through local devices, making it seem that a remote colleague was working normally. Supporting this facade, however, could be collaborations between foreign technical personnel, identity providers, payment arrangements, and equipment hosts. Impersonating technical personnel allows the individuals to complete work, receive payments, and acquire income for the North Korean-related network.

In another case disclosed during this same round of law enforcement announcements in June 2025, the prosecution alleged that related personnel implemented theft by using access permissions from their remote work at two cryptocurrency companies, one of which involved modifying the employer's smart contract source code, resulting in combined losses of over $900,000 for both companies. U.S. law enforcement agencies also warned that some impersonated remote personnel might steal corporate data and implement extortion.

The most challenging aspect here is that companies genuinely need technical talent. Remote collaboration reduces geographic limitations when hiring, making it more difficult to verify identity, location, and actual operators based on a single online interview. As long as an engineer can deliver on time, the business team may gradually grant him more permissions. Once those permissions cover code releases, production systems, or wallet operations, the gaps left by the initial identity verification will grow alongside the work.

After the Coins Are Stolen, Some People Step In

Stealing $1.5 billion in assets is one thing, while obtaining $1.5 billion that can be freely used is a different matter. Addresses may be marked, centralized platforms might intercept deposits, and some stablecoin issuers can freeze tokens based on their permissions and rules.

Therefore, managing funds after theft is not an incidental task, but rather a key factor in whether the operation can achieve actual profit.

The FBI mentioned in the announcement for the Bybit case that attackers quickly converted part of the assets into cryptocurrencies like Bitcoin, dispersing them across numerous addresses on multiple chains.

These actions increased the difficulty of tracking and interception, but they did not cause historical transactions to simply evaporate. For attackers, after on-chain transfers, a further question remains: who is willing to accept these assets, provide them with fiat currency, or fulfill real-world payments for them? At this moment, those who have mastery of exchange channels, accounts, and business contacts begin to become important.

In 2020, the U.S. Department of Justice prosecuted Tian Yiyin and Li Jiadong, two Chinese nationals, accusing them of laundering over $100 million in cryptocurrency assets for North Korean attackers. Prosecution materials state that the funds primarily originated from stolen exchanges, and the duo provided paid money transfer services through accounts and transfers. The case materials also claim that part of the laundered funds was used to pay for the infrastructure required to launch subsequent attacks against the financial sector.

This is what the prosecution disclosed, but it also takes the boundaries of the "hacker organization" a step further. The individuals who take the assets need to understand technology, while those who take over the assets might be more familiar with account openings, currency exchanges, and payments. Proceeds from stolen coins could also revert back to pay for the costs of the next round of actions. Simply tracking the programmers who implemented the invasion does not explain why this operation can keep running repeatedly.

The Tian Yiyin and Li Jiadong case also illustrates that recovering stolen funds involves more than just tracking where the coins went. Once the money flows into exchange accounts after being stolen from trading platforms, law enforcement personnel must also verify who is using the accounts and what connections the payees have with the invaders to piece together the links between coin theft and money laundering. To further determine that the attacks originated from North Korean-related organizations, clues beyond the funds must also be connected.

In the materials published in the Park Jin-hyuk case, the U.S. listed clues including email addresses and aliases reused in different attacks, similar malicious codes, and access records for related accounts. On-chain records of funds also need to corroborate with accounts, devices, and real personnel clues to gradually track who is behind the operations. Simply viewing a string of wallet addresses does not reveal the operator's nationality.

These investigative materials have brought certain individuals and collaborative methods to the surface, but the complete internal list remains unseen. Some attribution announcements only disclose conclusions and related addresses without providing all the investigative basis. Understanding Lazarus has accumulated gradually alongside each of these cases: we can see how they approach targets and how they move money, yet we cannot yet claim to have fully grasped the entire organization.

Conclusion

The cryptocurrency industry has created an open network that allows strangers to trade and collaborate, which we refer to as an open and free collaborative network. However, North Korean-related actions remind us that this same network is open to organized attackers: they can seek entry points in the same recruitment markets and later process their gains in the same financial markets. A country under financial sanctions may also leverage the efficiency of global markets to continue funding its activities.

In the openness and freedom of the encrypted world, there are always those who silently bear the costs.