By ChandlerZ, Foresight News
In crypto, money can move in minutes. A routine job approach or a software update can turn into an entry point to a massive theft. In the second installment of its feature series, Foresight News turns to Lazarus Group, the North Korea-linked hacking organization that has been tied to the Sony Pictures attack, the Bangladesh Bank theft and a long list of crypto heists. After the Binance breach, the group returned to the center of public attention.
In October 2026, Binance lost $6.34 billion in digital assets, the largest theft on record in the crypto industry. More than a month earlier, a Binance engineer received what looked like a standard interview invitation on a job platform. The supposed employer arranged a video interview, followed by a second round with someone claiming to be the company’s CEO. Near the end, the candidate was sent a programming assignment and asked to download it onto a work computer.
According to a preliminary investigation released on Nov. 3, the recruiting company was entirely fabricated by the attackers, and the assignment carried malicious code. That foothold let them compromise the engineer’s machine. On Oct. 20, they used an internal Binance AI tool for lateral movement, obtained a deployment-system permission token and eventually broke into the wallet-signing system. Binance said it urgently intercepted and froze about $2.85 billion, but the intrusion that began with a fake hiring process still became the biggest crypto theft to date.
The Federal Bureau of Investigation attributed the case to the North Korean hacking activity known as TraderTraitor, described here as a core branch of Lazarus Group. On the same day Binance was hit, Microsoft published a report saying North Korean hackers had fully folded generative AI into daily operations. The report said they were using AI to mass-produce fake recruiting firms, tailor interview scripts and even assist vulnerability exploitation with open-source AI tools.
After years of adaptation, the report says, this covert force has turned the crypto sector into a major source of foreign currency. Citing Chainalysis and the Korea Trade-Investment Promotion Agency, the article says North Korean hackers stole at least $2.02 billion in crypto in 2025, equal to 4.3 times North Korea’s goods exports of $469 million that year. TRM Labs estimated that by October 2026, North Korean hackers had stolen about $12.8 billion in total. Of the $8.7 billion lost globally to crypto hacks in 2026, 85% was attributed to North Korea-linked actors, up from 7% in 2020.
Why has Lazarus kept accelerating under sanctions and law-enforcement pressure, eventually accounting for more than four-fifths of the world’s biggest on-chain thefts? Who are the people behind the screens, how are they trained, how do they hide, and how are stolen funds cleaned up? The article starts with several exposed North Korean operators and works outward from there.
Exposed operators behind the screen
Getting a clear view of these “ghost programmers” has never been easy. Still, over more than a decade of cat-and-mouse investigations, a few cracks have appeared.
The first one surfaced in a résumé sent to Dalian, China, 15 years ago. In January 2011, the North Korean company Chosun Expo recommended a young developer named Pak Jin Hek, also known as Park Jin Hyok, to an overseas company to take over development work for a Dalian team. The résumé said Park had graduated from Kim Chaek University of Technology in Pyongyang, spoke English and Chinese, knew Java and had worked on online games. At the time, he looked like an ordinary overseas coder.
In May 2011, he wrote in an email that by September he would have lived in Dalian for a full year, that he planned to return to North Korea to get married, and that he hoped to stay in the country long term. A few months later, he told the other side he would be going back the following week.
Years later, while tracing the Sony Pictures attack, the $81 million theft from Bangladesh Bank and the WannaCry ransomware case, the FBI came across Park’s old work email. He had not fully severed his identities. The contact list in his everyday mailbox contained the address of an operational hacking account, “Kim Hyon Woo.” Another work account had permission to open encrypted cloud files used in hacking operations, and the accounts had shared the same devices and network addresses.
That overlap between ordinary life and operational infrastructure turned Park into one of the most recognizable faces on an FBI wanted poster. According to defected computer specialists interviewed by Reuters, talented science students in North Korea are screened repeatedly, then sent either into military cyber units or overseas. By day, they work as outsourced developers earning foreign currency. By night, they operate under state orders.
If Park still needed a physical overseas posting a decade ago, the next exposed infiltrator showed what disguise looks like in the AI era.
In July 2024, U.S. cybersecurity company KnowBe4 hired a remote senior engineer. The applicant had stolen the identity of a legitimate U.S. citizen and used an AI-enhanced synthetic profile photo. He passed four rounds of video interviews and all background checks. The problem emerged only when the company shipped out a Mac work laptop. The delivery address turned out to be a laptop farm in the United States, a setup used to host computers for overseas hackers and make their traffic appear to come from U.S. IP addresses. Less than 25 minutes after the machine was powered on, the “new employee” tried to deploy malware through a Raspberry Pi, triggering endpoint alerts. When the security team called to verify the activity, he stalled and cut off contact. Mandiant and the FBI later identified him as a North Korean infiltrator.
By 2025 and 2026, AI face swaps and fake identities had weakened ordinary background screening. In the crypto sector, the way a third North Korean operator was exposed carried a darkly comic edge.
As large numbers of North Korean IT workers posing as Japanese and American developers entered the Web3 industry, some crypto projects came up with what they called the “Kim Jong Un test.” In April 2026, blockchain security investigator Tanuki42 released an 82-second remote interview clip. The applicant, using the alias Taro Aikuchi and claiming to live in Meguro, Tokyo, handled technical questions smoothly. Then the interviewer abruptly asked him to repeat an insult directed at Kim Jong Un to rule out the possibility that he was a North Korean operative.
The supposed Japanese engineer immediately changed expression. He first pretended the signal was bad. When the interviewer pressed again, he fell silent and then disconnected in a rush. Within minutes, he changed his Telegram account, wiped records and deleted his LinkedIn page. The article says that even with advanced blockchain coding skills and AI deepfake tools, publicly insulting the country’s top leader remains a line North Korean operators will not cross under a tightly controlled system.
From Park Jin Hyok, whose shared email traces surfaced in a Dalian apartment, to the fake American engineer who passed four interviews with AI help, to the “Tokyo developer” who dropped offline over a political taboo, these three moments, spread across 15 years, reveal a small part of the Lazarus iceberg.
Lazarus is more than a theft crew
In November 2014, Sony Pictures suffered a destructive attack on its computer systems. Large volumes of unreleased internal material and executive emails were leaked, and a group calling itself “Guardians of Peace” claimed responsibility. Sony was preparing to release “The Interview,” a film built around a fictional plot to assassinate the North Korean leader. In later charges, the U.S. Department of Justice said North Korea-backed attackers not only stole data and crippled computers but also sent bomb threats to employees.
Months later, security company Novetta led a cross-case malware analysis. Researchers found that some of the code used in the Sony incident came from the same source as tools seen in earlier attacks. In 2016, the “Operation Blockbuster” report grouped that hidden offensive force under one name: Lazarus Group.
As investigations deepened, it became clear that Lazarus was not a single gang focused on stealing money. It was part of a tightly divided state apparatus. When the U.S. Treasury sanctioned Lazarus, BlueNoroff and Andariel in 2019, it explicitly linked them to North Korea’s Reconnaissance General Bureau, or RGB, the country’s top military intelligence agency.
In 2024, Unit 42, the threat intelligence arm of Palo Alto Networks, mapped the broader ecosystem. Under the RGB umbrella, multiple cyber activity clusters carry out different roles. Their targets extend well beyond crypto and include global finance, defense and military industry, and media and intelligence.
Within that network, the clusters focused on blockchain and crypto are only one part. The article points to Slow Pisces, also known as Jade Sleet, which overlaps with TraderTraitor in the Binance case, and Gleaming Pisces, also known as Citrine Sleet, which spread the AppleJeus malware through fake trading software.
Outside crypto, the other branches are just as striking. In traditional finance, Alluring Pisces, also known as BlueNoroff or APT38, had already turned the global banking system into a cash machine before the crypto bull market. Its most notorious case was the 2016 Bangladesh Bank heist.
In defense and military industry, Jumpy Pisces, also known as Andariel, is described as a technical espionage arm that funds itself through attacks. According to an indictment released by the U.S. Department of Justice in July 2024, the branch built a closed loop. It used Maui ransomware against multiple U.S. hospitals and medical institutions to extort funds, then used that money to buy servers and infiltrate U.S. defense contractors, air force bases and South Korean defense research institutions. The targets included design blueprints related to F-15 fighter jet engines, military reconnaissance satellites, submarines, and nuclear fuel and uranium enrichment facilities.
On the media and strategic intelligence side, Selective Pisces, or Diamond Sleet, and Sparkling Pisces, or Kimsuky, focused on stealing secrets and creating a chilling effect. Beyond earlier attacks that crippled entertainment giants such as Sony Pictures, they have in recent years posed as Western mainstream journalists and think tank scholars, sending malware-laced “interview outlines” or conference invitations to reporters, diplomats and defense think tanks covering North Korea. The article also says they created large numbers of lookalike social media accounts, posing as top security researchers to “counter-phish” security experts at companies such as Google in order to steal undisclosed software vulnerabilities and sensitive policy information.
Researchers usually separate these clusters by target selection, malware traits and server infrastructure. But when teams share code bases or relay servers, drawing a clean line around who carried out each operation becomes nearly impossible. What is clear, the article says, is that theft and espionage are tightly fused inside the same machine.
From central bank accounts to exchange wallets
Before crypto exchanges became the main target, banks had already drawn investigators’ attention.
In February 2016, computers connected to the SWIFT international banking messaging system at Bangladesh Bank were compromised. U.S. court documents said the attackers sent transfer instructions in the central bank’s name, asking the Federal Reserve Bank of New York to move U.S. dollars out of the bank’s account. They tried to transfer nearly $1 billion. Of that amount, $81 million reached accounts in the Philippines and then moved through banks, remittance channels and casinos. Another $20 million was blocked by the receiving bank in Sri Lanka. Investigators found that the Philippine recipient accounts had been opened under false names the year before.
Recipient accounts were only one part of the operation. The attackers also needed to understand how banks processed transfers. After studying APT38 intrusions into financial institutions, Mandiant found that once inside a victim network, the attackers collected credentials, located the computers used to process SWIFT transactions and waited for a chance to send transfer instructions. In the cases Mandiant observed, the attackers stayed inside victim networks for an average of about 155 days, with the longest case lasting nearly two years.
Years later, crypto funds became a major target as well. In 2022, the Ronin bridge used by Axie Infinity was hacked for more than $600 million, and the FBI attributed the attack to Lazarus. Two years later, Japanese exchange DMM Bitcoin lost 4,502.9 BTC, worth about $308 million at the time. U.S. and Japanese law enforcement attributed that case to TraderTraitor.
Investigators reconstructed the entry point in the DMM case. In March 2024, an attacker posing as a recruiter contacted an employee of wallet software company Ginco on LinkedIn and sent what was presented as a job test. It contained malicious code. After gaining access, the attacker impersonated that employee and then, according to investigators, used the company’s communication system to alter a legitimate DMM transaction request.
Then came Bybit. In February 2025, the exchange was preparing to move a quantity of ether from a cold wallet into a wallet used for daily operations. The cold wallet held assets, and the transfer required multiple authorized signers to approve it through the interface of wallet service provider Safe. Security company Sygnia, which investigated the incident, later said malicious activity had already appeared on a Safe developer’s computer on Feb. 4. The next day, the attackers used that developer’s access token to enter Safe’s cloud environment.
On Feb. 19, the attackers inserted malicious content into code called by the Safe web interface and set a trigger condition, waiting for the target Bybit wallet to initiate an action. Two days later, Bybit’s authorized personnel used the Safe interface to process what appeared to be a normal internal transfer request.
But according to a reconstruction by NCC Group, the transaction the signers actually approved contained a malicious operation. It called a contract pre-deployed by the attackers and changed the cold wallet’s control logic. Once the transaction executed, the attackers no longer needed the original multisignature approvals to move the assets. About $1.5 billion then flowed out.
Sygnia said the malicious code was removed about two minutes after the transaction took place. Its investigation said the initial compromise of the Safe developer’s computer may have involved social engineering, though the exact contact method had not been confirmed. Bybit’s multisignature setup was meant to reduce the risk of a single compromised account. Once the attackers got into Safe’s cloud environment, however, they altered the shared web page used by all signers and got the malicious transaction approved.
Infiltrating software providers is not the only route. Some North Korean operatives have also been accused of entering crypto companies under false identities. In 2025, the U.S. Department of Justice charged four North Korean citizens in a theft scheme. Two of them had been hired as developers by a blockchain company and a virtual token company. Prosecutors said they used those jobs to steal and transfer more than $900,000 in virtual assets.
The hiring process can also be a trap from the other side. Microsoft, in its investigation of a cluster it calls Sapphire Sleet, said attackers posed as recruiters on social platforms, discussed job opportunities with targets, then arranged technical interviews and asked them to install malware disguised as meeting tools or developer-tool updates. The job test sent to the Ginco employee in the DMM case appeared in a similar contact chain.
Those methods are still changing. In an October 2026 report, Microsoft said North Korea-linked attackers were using generative AI to research targets, write outreach messages and shape false identities. An invitation that looks carefully tailored to a candidate’s work history may be backed by prior collection on that person’s background and social connections.
Where the stolen money goes
Once funds are moved, the attackers usually split them across multiple fresh wallets. Some of those addresses then pass the money onward in stages, leaving a scattered on-chain trail. The assets may then be swapped through decentralized exchanges or cross-chain services into other tokens or moved onto another blockchain. Each conversion creates a new set of addresses and counterparties for investigators to follow.
The flow of funds after the Bybit theft offers one example. In February 2025, the stolen ether began moving to thousands of addresses. The attackers split the funds, swapped them and then moved them through cross-chain services. TRM Labs said that within 48 hours, at least $160 million had already been transferred into laundering channels.
While tracking those transfers, on-chain investigator ZachXBT noticed another group of actors. According to an investigation he made public in October 2026, more than a dozen accounts appeared in public Telegram and Discord groups after the Bybit attack, looking to process orders tied to the stolen funds. One trader using the handle Jimmy Green drew his attention.
ZachXBT decided to approach him as a customer. On March 6, 2025, he sent 349,700 USDC to a new address in preparation for multiple trades with Jimmy. Jimmy provided a receiving address and asked him to send USDC on Ethereum in exchange for USDT on Tron. ZachXBT traced the wallet that paid gas fees for that receiving address and found it could be linked back to the Bybit theft and appeared on public lists of addresses tied to the case.
To keep the contact going, ZachXBT completed several more trades with Jimmy, taking a loss of about 5% on each one. They talked about trading, but also about mahjong, food and family. As the contact deepened, Jimmy began discussing his team’s business, including moving Bybit funds for North Korean clients and the team’s operations in Hong Kong and mainland China.
ZachXBT said Jimmy told him one day in advance that a transfer would move to Solana, and a matching on-chain transfer appeared the next day. On March 12, Jimmy sent a screenshot of a cross-chain transaction. Using the amount and timing, ZachXBT found the matching order on THORChain. Three Solana addresses later provided by Jimmy helped him trace a group of Bybit funds worth more than $12 million. According to ZachXBT, Tether later froze 442,000 USDT tied to that set of addresses.
Jimmy also claimed that his team handled most of the stolen Bybit assets. ZachXBT said the laundering pattern he observed matched that claim. He passed his findings to law-enforcement personnel and private-sector investigators involved in the case, and did not make the experience public until October 2026.
After the security incident, Binance said about $3 billion in assets tied to the case had been frozen on-chain. TRM Labs observed that the attackers sold part of the assets through decentralized exchanges and market makers, and also posted some of the stolen assets as collateral on lending protocols including Aave and JustLend to borrow other assets.
At the same time, Binance moved to make customers whole. On Nov. 2, the platform said about 95% of the affected assets had been replenished and released proof of reserves for some major assets. On Nov. 3, Binance said it had restored withdrawals for more assets and networks, while the security investigation was still underway.
