Lazarus moved 244.148 Bitcoin worth $19.4 million, Lookonchain says
The North Korean hacking group Lazarus moved 244.148 BTC, worth about $19.42 million, according to Lookonchain. For PSPs, exchanges, and crypto compliance teams, the important part is not just the transfer itself, but the fact that the destination is still unknown: that leaves open whether the funds went to an exchange, a mixer, or another wallet under Lazarus control.
- Lookonchain said the transfer happened an hour before its August 28, 2026 post, and the receiving address has not been identified. On paper, a Bitcoin move is just a move; in practice, the destination is what tells you whether this is treasury reshuffling, laundering preparation, or an attempt to cash out.
- This was the second large transfer linked to North Korean hackers in a month. On August 12, Lazarus moved 262.2 BTC worth $16.6 million from an address identified by Lookonchain to a new crypto address.
- In March last year, transactions traced by Arkham Intelligence showed 44.07 BTC, worth $3.76 million at the time, being sent from Lazarus-controlled crypto addresses to five unknown addresses.
- Bybit, the Dubai-based crypto exchange, filed a lawsuit in early August against North Korea and Lazarus Group in the U.S. District Court for the District of Columbia, seeking the return of $1.5 billion in crypto assets stolen in the February 2025 hack. The complaint also names North Korea’s Reconnaissance General Bureau.
- A federal judge issued an order barring the defendants from transferring or selling assets tied to the case. The FBI has attributed the Bybit attack to North Korean hackers from the TraderTraitor group and said they converted part of the stolen funds into Bitcoin and spread them across thousands of addresses on different blockchains.
The FBI also said it expected further movement of the assets and possible conversion into fiat, and asked exchanges, bridges, DeFi services, analytics firms, and node operators to block transactions linked to the identified addresses.
Weekly high-risk digest
Regulation, sanctions and payment news across your verticals — once a week, free.
Please check your inbox and click the link to confirm your subscription.
Please enter a valid email address!