Written by: ChandlerZ, Foresight News
Editor's note: In the world of cryptocurrency, wealth can be transferred in minutes. A seemingly ordinary recruitment, a software update, may hide an entry point to massive assets. The Foresight News column "Crypto Storytelling" tracks the people behind those bizarre events, searching for the parts of the story that remain unclear along the clues of public data and funding.
In this second issue, we approach the Lazarus Group. This hacker organization related to North Korea has been linked to attacks on Sony Pictures, the theft of $81 million from the Bangladesh Central Bank, and several cases of cryptocurrency theft. After Binance was attacked, it appeared in the public eye once again. Where do these people hidden behind the screens come from? How do they approach their targets, and how do they transfer the stolen assets?
In October 2026, $6.34 billion in digital assets was stolen from Binance, setting a historical record for the cryptocurrency industry.
Just over a month earlier, a Binance engineer received what seemed like an ordinary interview invitation on a job platform. The recruiter first arranged a video interview, and then had someone claiming to be the company's CEO conduct a second interview. Near the end, the other party sent a programming assignment, asking the engineer to download it onto his work computer.
According to a preliminary investigation report released on November 3, the recruiting company was entirely fictitious, and the assignment contained malicious code. The attackers used this to infiltrate the engineer's computer and on October 20, leveraged Binance's internal AI tools to move laterally, gaining access to deployment system access tokens, ultimately compromising the wallet signing system. Although Binance urgently intercepted and froze about $2.85 billion, this intrusion that began with "fake recruitment" still set a theft record in the cryptocurrency industry.
The FBI attributed this case to the North Korean hacker activity TraderTraitor, which is the infamous core branch of the Lazarus Group. On the same day Binance was attacked, a report released by Microsoft revealed a more dangerous evolution: this group of North Korean hackers has fully integrated generative AI into their daily operations, not only using AI to mass-fabricate recruiting companies and customize interview scripts but even directly aiding vulnerability exploitation with open-source AI tools.
After years of evolution, this covert force has transformed the cryptocurrency industry into a massive foreign exchange earning machine. According to data from Chainalysis and the Korea Trade-Investment Promotion Agency, North Korean hackers stole at least $2.02 billion in cryptocurrency assets in 2025, which is 4.3 times the country's national merchandise export value of $469 million that year. TRM Labs estimates that by October 2026, North Korean hackers had stolen approximately $12.8 billion; among the global cryptocurrency hacker losses of $8.7 billion in 2026, North Korea alone monopolized 85% of the share, compared to only 7% in 2020.
Why, under continuous investigations and strict sanctions by law enforcement agencies around the world, is Lazarus stealing more aggressively, even accounting for over 80% of global on-chain major thefts? Who are these people hidden behind the screens, how do they train, how do they lurk, and how do they launder tens of billions of ill-gotten gains?
These questions may begin to unravel from the exposed North Korean hackers.
Exposed North Korean Hackers
It is not easy to see the true nature of this group of "phantom programmers," but over more than a decade of cat-and-mouse games, there are still a few cracks that allow the outside world to glimpse the true faces behind the screens.
The first crack appeared in a resume sent to Dalian, China 15 years ago.
In January 2011, the North Korean company Chosun Expo recommended a young man named Pak Jin Hek (i.e., Park Jin Hyok, 박진혁), a graduate of Kim Chaek University of Technology in Pyongyang, to an overseas company to take over development work for the Dalian team. The resume stated that Park was bilingual in English and Mandarin, proficient in Java, and had experience in online game development. He looked like just an ordinary code worker stationed abroad at the time.
In May 2011, he casually mentioned in an email that he had been living in Dalian for a year since September and was planning to return to North Korea to get married, hoping to stay in the country for a long time. A few months later, he informed the other party that he would return to his homeland the following week.
Park Jin Hyok wanted poster used by CBS
However, years later, when the FBI traced back the Sony Pictures attack, the $81 million theft from the Bangladesh Central Bank, and the WannaCry ransomware incident, they unexpectedly uncovered Park's work email from back then. He forgot to fully cut ties: in his daily email address book, there was a striking contact for the hacker operation account "Kim Hyon Woo," and another work account had access to decrypt hacker cloud files and even shared the same devices and network address.
This faint trace of life intersecting with the operational network turned Park into a symbolic face on the FBI's most wanted list. According to North Korean defectors interviewed by Reuters, gifted science students in North Korea are filtered layer by layer, sent to military cybersecurity departments or dispatched overseas.
By day, they are outsourced code workers earning foreign exchange for the company; by night, they are darknet hunters responding to state orders.
If the Park of a decade ago still needed to be physically stationed abroad, the second exposed infiltrator showcased the frightening "perfect disguise" of the AI era.
In July 2024, a U.S. cybersecurity company, KnowBe4, hired a remote senior engineer. The job applicant stole a legitimate U.S. citizen's identity, backed by an AI-enhanced synthetic avatar, and passed four rounds of video interviews and all background checks. The flaw only emerged when the company shipped a Mac work computer, the delivery address actually being a laptop farm in the U.S., which specializes in hosting computers for foreign hackers to fabricate U.S. IPs. Within less than 25 minutes of booting up the computer, this "new employee" eagerly implanted malware via a Raspberry Pi, instantly triggering an endpoint alert. When the security team called to verify, the other party quickly stuttered and disconnected, ultimately confirmed by Mandiant and the FBI as a North Korean infiltrator.
By 2025 to 2026, as AI face-swapping and fake identities rendered conventional background checks ineffective, the method used to catch the third North Korean hacker in the crypto circle was filled with dark humor.
As a large number of North Korean IT personnel disguised as Japanese and American developers flooded into the Web3 industry, some beleaguered crypto projects invented a failsafe ultimate interview question known as the "Kim Jong Un Test." In April 2026, blockchain security investigator Tanuki42 publicly released an 82-second remote interview video: the job applicant, using the pseudonym Taro Aikuchi and claiming to live in Tokyo's Meguro district, answered technical questions fluently, but when the interviewer suddenly asked him to repeat a vulgar insult against Kim Jong Un to rule out North Korean agents, this "Japanese engineer" suddenly changed color.
He first pretended the signal was bad, then fell silent after the interviewer pressed again, and hurriedly cut the connection. Within minutes, he rapidly modified his Telegram account, cleared records, and deactivated his LinkedIn page.
Even though these technicians are well-versed in cutting-edge blockchain code and AI deepfake technology, under stringent monitoring and collective punishment systems, publicly insulting the supreme leader remains an absolute line they dare not cross.
From Park Jin Hyok sharing an email in a Dalian rental room, to the fake American engineer who deceived through four interviews using AI, and then to the "Tokyo developer" who disconnected instantly due to a political taboo, these three exposed moments spanning 15 years piece together a glimpse of the vast iceberg that is Lazarus.
Lazarus, More Than Just "Cyber Heists"
In November 2014, Sony Pictures' computer systems were compromised, with a large number of internal unpublished materials and executive emails leaked. An organization claiming to be the "Guardians of Peace" announced responsibility. At that time, Sony was preparing to release a film called "The Interview," depicting a fictional assassination of North Korean leader Kim Jong Un. In subsequent charges, the U.S. Department of Justice stated that the North Korean-supported attackers not only stole data and crippled computers but also issued bomb threats to employees.
Months later, the security company Novetta led a multi-case traceability investigation on the malware involved in the attack. Researchers discovered that part of the code from the Sony incident originated from tools used in several prior cyber attacks. The report titled "Operation Blockbuster," released in 2016, consolidated this hidden force of attackers under the name "Lazarus Group."
As investigations deepened, the public gradually realized that Lazarus was not a singular robbery gang but part of a tightly organized state apparatus. When the U.S. Treasury sanctioned Lazarus, BlueNoroff, and Andariel in 2019, it explicitly identified them as tied to North Korea's top military intelligence agency, the Reconnaissance General Bureau (RGB).
The security company Palo Alto Networks' Unit 42 created a panoramic relationship chart in 2024. Under the command umbrella of the Reconnaissance General Bureau, multiple clusters of cyber activities perform distinct roles, with their hunting grounds having long surpassed the cryptocurrency industry, encompassing global finance, defense contracting, and media intelligence.
Network activity clusters related to the North Korean Reconnaissance General Bureau plotted by Unit 42 in 2024
In this network, the main focus on blockchain and the cryptocurrency industry is just one part, such as Slow Pisces (also known as Jade Sleet), which overlaps with the Binance case TraderTraitor, and Gleaming Pisces (also known as Citrine Sleet), which specializes in spreading AppleJeus malware through fake trading software.
Outside the cryptocurrency circle, other branches' actions are equally thrilling. In the traditional finance sector, Alluring Pisces (i.e., BlueNoroff/APT38) has treated the global banking system as a cash machine long before the cryptocurrency bull market. Its most sensational representative case is the 2016 theft from the Bangladesh Central Bank.
In defense and military industries, Jumpy Pisces (i.e., Andariel) plays the role of a technological thief, "sustaining war through war." According to a July 2024 indictment released by the U.S. Department of Justice, this branch formed a unique closed loop. They simultaneously attacked several U.S. hospitals and medical institutions using Maui ransomware, coercing ransom to fund their operations, while using this money to purchase servers and infiltrating U.S. defense contractors, air force bases, and South Korean defense research institutions to specifically steal blueprints for F-15 fighter engines, military reconnaissance satellites, submarines, and nuclear fuel and uranium enrichment facilities.
In media and strategic intelligence, Selective Pisces (Diamond Sleet) and Sparkling Pisces (Kimsuky) focus on stealing secrets and creating a chilling effect. In addition to previously crippling giants like Sony Pictures, they have recently disguised themselves as mainstream media journalists and think tank scholars in Europe and the U.S., sending Trojan-infected "interview outlines" or meeting invitations to Western journalists, diplomats, and defense think tanks reporting on North Korean affairs; they even registered batches of highly imitative accounts on social media, posing as top security researchers to "phish" Google's security experts, thereby stealing unpublished software vulnerabilities (0-day) and countries' strategic plans toward North Korea.
Researchers primarily categorize clusters based on attack targets, malware characteristics, and server infrastructure, but when different teams share codebases or compromise servers during operations, it is nearly impossible to neatly delineate which group carried out each action, much like slicing tofu.
However, it can be confirmed that "robbing" and "espionage" have long been highly intertwined in this machinery.
From Central Bank Accounts to Exchange Wallets
Before cryptocurrency exchanges became prime targets, banks had already entered investigators' sights.
In February 2016, computers connected to the SWIFT international banking messaging system at the Bangladesh Central Bank were compromised. U.S. judicial documents state that attackers sent transfer instructions in the name of the central bank, requesting the New York Federal Reserve Bank to transfer dollars from the central bank's account to overseas.
The attackers attempted to transfer nearly $1 billion, of which $81 million reached accounts in the Philippines, subsequently flowing through banks, remittance institutions, and casinos; another $20 million was intercepted by a receiving bank in Sri Lanka. Investigators found that the receiving account in the Philippines had been opened with a false name a year earlier.
Besides the receiving accounts, the attackers also needed to understand how the bank processed transfers. After studying APT38's attacks on financial institutions, Mandiant discovered that after entering the victim's network, they would gather account credentials, identify the computers handling SWIFT transactions, and find opportunities for sending transfer instructions. In cases observed by the company, attackers remained within the victim's network for an average of about 155 days, with one case lasting nearly two years.
Mandiant’s analysis of APT38 attack flow
Years later, funds from the cryptocurrency industry gradually became targets as well. In 2022, the Ronin cross-chain bridge used by the blockchain game Axie Infinity was compromised, resulting in losses exceeding $600 million, with the FBI attributing the attack to Lazarus. Two years later, the Japanese exchange DMM Bitcoin lost 4,502.9 bitcoins, worth approximately $308 million at the time of the incident. U.S. and Japanese law enforcement agencies attributed the case to TraderTraitor.
Investigators reconstructed the entry point of the DMM case when, in March 2024, an attacker posing as a recruiter contacted an employee of wallet software company Ginco on LinkedIn, sending a so-called job test that contained malicious code. After gaining access, the attacker impersonated the employee and reportedly altered a normal transaction request from DMM using the company's communication system.
By February 2025, the cryptocurrency exchange Bybit was preparing to move some Ethereum from a cold wallet to an operational wallet. Cold wallets are used for asset storage, and this transfer required approval through the wallet service provider Safe's interface, needing multiple authorized personnel to sign off together. The security company Sygnia later analyzed the attack process and found that malicious activity had already appeared on a developer's computer at Safe as early as February 4; the next day, the attacker used this developer's access token to enter Safe's cloud environment.
On February 19, the attacker implanted malicious content into the code called by the Safe webpage and set trigger conditions, waiting for Bybit's target wallet to initiate an operation. Two days later, Bybit's authorized personnel processed the transfer via the Safe interface, seeing what appeared to be a normal internal transfer request.
However, according to a review by the security company NCC Group, the transaction that the signers actually approved contained a malicious operation that invoked a contract previously deployed by the attacker, altering the control logic of the cold wallet. After executing the transaction, the attacker could transfer the assets in the wallet without needing to obtain the original multi-signature again. Approximately $1.5 billion in assets subsequently flowed out.
A diagram of the theft process of Bybit created by Curvegrid
According to an investigation by Sygnia, the malicious code was removed about two minutes after the transaction occurred. The investigation believes that the initial breach of the Safe developer's computer may have involved social engineering, but the specific means of contact remains unconfirmed.
Bybit's multi-signature setup required several authorized personnel to jointly approve transactions, which could have reduced the risk associated with an individual account compromising. After the attacker accessed Safe's cloud environment, they altered the webpage shared by these signers, ultimately allowing the malicious transaction to gain approval.
In addition to infiltrating software service providers, some North Korean personnel have also been accused of using false identities to enter cryptocurrency companies. In 2025, the U.S. Department of Justice charged four North Korean citizens involved in a theft scheme, two of whom were employed as developers at a blockchain company and a virtual currency company, respectively. Prosecutors stated that they used their job opportunities to steal and transfer over $900,000 in virtual assets.
It is worth noting that there may also be traps hidden at the other end of the recruitment process. After investigating an activity cluster they called Sapphire Sleet, Microsoft found that attackers impersonate recruiters on social platforms, first discussing job opportunities with targets, then arranging technical interviews, asking them to install malware disguised as meeting tools or development tool updates. The job test received by the Ginco employee in the DMM case also appeared in similar contact processes.
These tactics are still being updated. In a report from October 2026, Microsoft pointed out that North Korean-related attackers have used generative AI to research targets, compose contact content, and shape false identities. An invitation that appears meticulously prepared for the job seeker's experience may have been compiled through the collection of their work background and social connections.
Where Did the Stolen Money Go?
After transferring the assets, attackers usually first split the funds into multiple new wallets, with some addresses transferring smaller amounts sequentially, leaving scattered on-chain records. The funds may then go through decentralized exchanges or cross-chain services, being exchanged for other tokens or moved to another blockchain. Each conversion requires investigators to continue tracking new addresses and their transaction counterparts.
The flow of funds after the Bybit theft provided a clue: in February 2025, the Ethereum stolen from Bybit began flowing to thousands of addresses. The attackers split, exchanged the funds, and transferred them through cross-chain services. According to TRM Labs, within 48 hours, at least $160 million had been transferred and channeled into money laundering.
While tracking these transfers, on-chain investigator ZachXBT noticed another group of individuals. According to his investigation published in October 2026, more than a dozen accounts appeared in public Telegram and Discord groups seeking to handle orders related to the stolen funds after Bybit was attacked. A trader using the pseudonym Jimmy Green caught his attention.
ZachXBT decided to approach him as a customer. On March 6, 2025, he transferred 349,700 USDC to a new address, preparing to engage in multiple transactions with Jimmy. Jimmy provided a receiving address, allowing him to transfer USDC on the Ethereum chain and exchange it for USDT on the Tron chain. ZachXBT tracked and found that the wallet paying on-chain transaction fees for this receiving address could be traced back to the stolen funds from Bybit and appeared on the public list of involved addresses.
To continue contact with Jimmy, ZachXBT completed multiple transactions with him, incurring approximately 5% losses per transaction. The two discussed trades, as well as mahjong, food, and family. As contact increased, Jimmy began to talk to this customer he thought he was about his team's business, including how they transferred Bybit funds for North Korean clients and the operations of the team in Hong Kong and mainland China.
ZachXBT stated that Jimmy had informed him a day in advance that a certain amount of funds would be transferred to Solana, and the next day the corresponding transfer appeared on-chain. On March 12, Jimmy sent a screenshot of a cross-chain transaction, and based on the amount and time, ZachXBT matched it to an order he found on THORChain. The three Solana addresses subsequently provided by Jimmy helped him trace a set of stolen Bybit funds worth over $12 million; according to him, Tether later froze 442,000 USDT linked to this set of addresses.
Jimmy also claimed to ZachXBT that his team handled most of the stolen assets from Bybit. ZachXBT believed that the money laundering patterns he observed were consistent with this claim. He shared the findings with law enforcement and private agency investigators involved in the case, only revealing this experience publicly in October 2026.
After the security incident, Binance announced that approximately $3 billion in assets related to the incident had been frozen on-chain. TRM Labs observed that the attackers sold part of the assets through decentralized exchanges and market makers, also mortgaging some of the stolen assets in lending protocols such as Aave and JustLend to borrow other assets.
Meanwhile, Binance began compensating the affected assets, stating on November 2 that about 95% of the affected assets had been compensated, and published proofs of reserves for some major assets. On November 3, Binance announced further restoration of more assets and network withdrawals, with security investigations still ongoing.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。
