Written by: ChandlerZ, Foresight News
Editor's note: In the crypto world, wealth can shift within minutes; an ordinary-looking recruitment or a software update may hide the gateway to enormous assets. Foresight News' column "Crypto Story Session" tracks the people behind those bizarre incidents, following public records and financial clues to find the parts of the story that have not yet been clearly seen.
In the second installment, we take a closer look at Lazarus Group. This hacker group linked to North Korea has been accused of involvement in the Sony Pictures attack, the theft from the Bangladesh central bank, and multiple crypto asset thefts. After the Binance attack, it once again appeared in the public eye. Where do these people hiding behind screens come from? How do they approach their targets, and how do they move the stolen assets?
In October 2026, $6.34 billion in digital assets were stolen from Binance, setting a record in the crypto industry's history.
Just over a month earlier, a Binance engineer received what looked like an ordinary interview invitation on a job platform. The recruiter first arranged a video interview, then asked a person claiming to be the company's CEO to conduct a second-round interview. Near the end, the other party sent a programming assignment and asked the engineer to download it onto his work computer.
According to a preliminary investigation report released on November 3, the recruiting company was entirely fabricated by the attackers, and the assignment contained malicious code. The attackers used this to infiltrate the engineer's computer and, on October 20, used Binance's internal AI tools for lateral movement, obtained permission tokens for the deployment system, and ultimately breached the wallet signing system. Although Binance urgently intercepted and froze about $2.85 billion, this intrusion, which began with a "fake recruitment," still set the crypto industry's theft record.
The U.S. Federal Bureau of Investigation (FBI) attributed the case to the North Korean hacking campaign TraderTraitor, which is the core branch of the notorious Lazarus Group. On the same day Binance was attacked, an investigation report released by Microsoft revealed an even more dangerous evolution: this group of North Korean hackers has fully incorporated generative AI into its daily operations, not only using AI to mass-forge recruiting companies and customize interview scripts, but even directly using open-source AI tools to assist in vulnerability exploitation.
After years of evolution, this covert unit has turned the crypto industry into a massive foreign-exchange-earning machine. According to data from Chainalysis and the Korea Trade-Investment Promotion Agency, North Korean hackers stole at least $2.02 billion in crypto assets in 2025, 4.3 times North Korea's total goods exports that year ($469 million). TRM Labs estimates that, as of October 2026, North Korean hackers had stolen about $12.8 billion cumulatively; of the $8.7 billion in global crypto hacker losses in 2026, North Korea alone monopolized an 85% share, while in 2020 that proportion was only 7%.
Why is it that, despite sustained investigations and severe sanctions by law enforcement agencies around the world, Lazarus steals more and more aggressively, even accounting for more than 80% of the world's on-chain mega-heists? Who exactly are these people hiding behind screens, how are they trained, how do they lie low, and how do they launder tens of billions in stolen funds?
These questions may be answered by starting with the North Korean hackers who have been discovered.
The Discovered North Korean Hackers
It is not easy to see the true face of these "ghost programmers," but in more than a decade of cat-and-mouse games, several cracks have still allowed the outside world to glimpse the reality behind the screens.
The first crack appeared in a resume sent to Dalian, China, 15 years ago.
In January 2011, the North Korean company Chosun Expo recommended to an overseas enterprise a young man named Pak Jin Hek (Park Jin Hyok), a graduate of Pyongyang's Kim Chaek University of Technology, to take over development work for the Dalian team. In the resume, Park knew both English and Chinese, was proficient in Java, and had done online game development. At the time, he looked like just an ordinary overseas coder.
In May 2011, he chatted in an email that he would have lived in Dalian for a full year by September and was preparing to return to North Korea to get married, hoping to stay in the country for the long term. A few months later, he told the other party that he would return home the following week.
Park Jin Hyok wanted poster image used in CBS reporting
However, years later, when the FBI traced the Sony Pictures attack, the $81 million theft from the Bangladesh central bank, and the WannaCry ransomware case, it unexpectedly turned up Park's old work email. He had forgotten to sever all ties: his personal email's contact list conspicuously stored the address of the hacking operation account "Kim Hyon Woo," another work account had permission to open the hackers' encrypted cloud files, and he had even shared the same devices and network addresses.
This intersection of a trace of daily life and the operation network made Park an iconic face on the FBI's wanted list. According to North Korean defectors with computer backgrounds interviewed by Reuters, talented science students in North Korea are screened layer by layer and sent to military cyber departments or dispatched overseas.
By day, they are outsourced coders earning foreign exchange for companies; by night, they are dark-web hunters taking orders from the state.
If Park a decade ago still needed to be physically stationed overseas, the second exposed infiltrator demonstrated the terrifying "perfect disguise" of the AI era.
In July 2024, the U.S. cybersecurity company KnowBe4 hired a remote senior engineer. The job applicant stole a legitimate U.S. citizen's identity, used an AI-retouched composite headshot, and passed four rounds of video interviews and all background checks. The flaw only emerged when the company sent out a Mac work computer: the delivery address was actually a laptop farm in the United States that specialized in hosting computers for overseas hackers to fake U.S. IPs. Less than 25 minutes after the computer was turned on, the "new employee" could not wait to implant malware through a Raspberry Pi, instantly triggering a terminal alert. When the security team called to verify, the person quickly stammered and disconnected, and was ultimately confirmed by Mandiant and the FBI as a North Korean infiltrator.
By 2025 to 2026, when AI face-swapping and fake identities rendered conventional background checks ineffective, the crypto world's way of catching the third North Korean hacker was even more darkly humorous.
As large numbers of North Korean IT personnel disguised as Japanese and American developers flooded into the Web3 industry, some crypto projects that had had enough invented an ultimate interview question that worked every time: the "Kim Jong Un test." In April 2026, blockchain security investigator Tanuki42 publicly released an 82-second remote interview recording: an applicant using the alias Taro Aikuchi and claiming to live in Meguro, Tokyo, answered technical questions fluently, but when the interviewer suddenly asked him to repeat a profanity insulting Kim Jong Un to rule out North Korean spies, the "Japanese engineer" instantly changed expression.
He first pretended the signal was bad, fell silent after the interviewer pressed again, and then hurriedly cut the connection. Within minutes, he quickly changed his Telegram account, cleared the records, and deleted his LinkedIn page.
Even though these technical personnel have mastered the most cutting-edge blockchain code and AI deepfake technology, under strict surveillance and a system of collective punishment, publicly insulting the supreme leader remains a life-and-death red line they absolutely dare not cross.
From Park Jin Hyok sharing an email in a Dalian rental apartment, to the fake American engineer who used AI to fool four rounds of interviews, to the "Tokyo developer" who cut the network cable in seconds because of a political taboo, these three moments of exposure spanning 15 years piece together one corner of the enormous iceberg that is Lazarus.
Lazarus, More Than Just "Cyber Money-Grabbing"
In November 2014, Sony Pictures' computer systems were compromised, leaking a large amount of internal unpublished materials and executive emails. An organization calling itself "Guardians of Peace" claimed responsibility. At the time, Sony was preparing to release the film The Interview, which depicted a fictional plot to assassinate the North Korean leader. In subsequent indictments, the U.S. Department of Justice stated that the North Korea-backed attackers not only stole data and crippled computers but also sent bomb threats to employees.
A few months later, security firm Novetta led a cross-case attribution effort targeting the malware used in the attacks. Researchers found that some of the code in the Sony incident shared a common origin with tools left behind in multiple prior cyberattacks. The 2016 "Operation Blockbuster" report collectively referred to this hidden attacking force as the "Lazarus Group."
As investigations deepened, the outside world gradually came to realize that Lazarus was not a single money-grabbing gang but a highly compartmentalized state machine. When the U.S. Department of the Treasury sanctioned Lazarus, BlueNoroff, and Andariel in 2019, it explicitly linked them to North Korea's top military intelligence agency, the Reconnaissance General Bureau (RGB).
Unit 42, under security firm Palo Alto Networks, drew a panoramic relationship map in 2024. Under the command umbrella of the Reconnaissance General Bureau, multiple cyber activity clusters each performed their own functions, and their hunting grounds had long since extended beyond the cryptocurrency industry to cover global finance, defense and military industry, and media intelligence.
Relationship map of North Korean Reconnaissance General Bureau-related cyber activity clusters drawn by Unit 42 in 2024
In this network, only a portion focused primarily on blockchain and the cryptocurrency industry, such as Slow Pisces (also known as Jade Sleet), which overlaps with the Binance case TraderTraitor, and Gleaming Pisces (also known as Citrine Sleet), which specializes in spreading the AppleJeus trojan through fake trading software.
Outside the cryptocurrency circle, the operations of other branches were equally breathtaking. In traditional finance, Alluring Pisces (i.e., BlueNoroff/APT38) had already treated the global banking system as an ATM long before the crypto bull market. Its most sensational representative work was the 2016 Bangladesh central bank heist.
In the defense and military industry, Jumpy Pisces (i.e., Andariel) played the role of a technology thief that "sustains war through war." According to an indictment released by the U.S. Department of Justice in July 2024, this branch formed a unique closed loop. On one hand, they used Maui ransomware to attack multiple U.S. hospitals and medical institutions, demanding ransoms to raise operational funds; on the other hand, they used that money to buy servers and infiltrate U.S. defense contractors, air force bases, and South Korean defense research and development institutions, specifically stealing classified design blueprints for F-15 fighter engines, military reconnaissance satellites, submarines, and nuclear fuel and uranium enrichment facilities.
In media and strategic intelligence, Selective Pisces (Diamond Sleet) and Sparkling Pisces (Kimsuky) focused their efforts on stealing secrets and creating a chilling effect. In addition to paralyzing entertainment giants like Sony Pictures in earlier years, in recent years they repeatedly posed as journalists from mainstream Western media and think tank scholars, sending "interview outlines" or conference invitations containing trojans to Western journalists, diplomats, and defense think tanks reporting on North Korean affairs; they even registered high-fidelity impersonation accounts in bulk on social media, posing as top security researchers to "anti-phish" security experts at companies like Google, thereby stealing undisclosed software vulnerabilities (0-days) and various countries' bottom-line policies toward North Korea.
Researchers mainly divide clusters based on attack targets, malware characteristics, and server infrastructure, but when different teams share code repositories or jump servers during operations, it is nearly impossible to cleanly distinguish, like cutting tofu, exactly which group carried out each operation.
But what is certain is that "money-grabbing" and "secret-stealing" have long been highly interlocked within this machine.
From Central Bank Accounts to Exchange Wallets
Before crypto exchanges became primary targets, banks had already entered investigators' field of view.
In February 2016, computers at the Bangladesh central bank connected to the SWIFT international bank messaging system were compromised. U.S. judicial documents stated that the attackers issued transfer instructions in the name of the central bank, requesting the Federal Reserve Bank of New York to send U.S. dollars from the central bank's account overseas.
The attackers attempted to transfer nearly $1 billion, of which $81 million reached accounts in the Philippines and then passed through banks, remittance agencies, and casino channels; another $20 million was intercepted by the receiving bank in Sri Lanka. Investigators found that the Philippine receiving accounts had been opened with fake names as early as the previous year.
Beyond receiving accounts, the attackers also needed to understand how banks processed transfers. After studying APT38's attacks on financial institutions, Mandiant found that after entering a victim institution's network, they would collect account credentials, locate computers handling SWIFT transactions, and then seek opportunities to send transfer instructions. In the cases observed by the company, attackers stayed inside victim networks for an average of about 155 days, with the longest nearly two years.
APT38 attack flow outlined by Mandiant
A few years later, funds in the cryptocurrency industry also gradually became targets. In 2022, the Ronin cross-chain bridge used by blockchain game Axie Infinity was stolen, with losses exceeding $600 million, and the FBI attributed the attack to Lazarus. Two years later, Japanese exchange DMM Bitcoin lost 4,502.9 bitcoins, worth about $308 million at the time of the incident. U.S. and Japanese law enforcement agencies attributed the case to TraderTraitor.
Investigators reconstructed the entry point of the DMM case. In March 2024, an attacker posing as a recruiter contacted an employee of wallet software company Ginco on LinkedIn and sent a so-called job test that contained malicious code. After gaining access, the attacker impersonated this employee and then used the company's communication system to allegedly tamper with a normal transaction request from DMM.
By February 2025, crypto exchange Bybit was preparing to transfer a sum of Ethereum from a cold wallet to a wallet used for daily operations. Cold wallets are used to store assets, and this transfer needed to go through the interface of wallet service provider Safe and be jointly signed by multiple authorized personnel. Security firm Sygnia, which led the investigation, later reconstructed the attack process. As early as February 4, malicious activity had already appeared on a Safe developer's computer; the next day, the attacker used that developer's access token to enter Safe's cloud environment.
On February 19, the attacker implanted malicious content into code called by the Safe webpage and set trigger conditions, waiting for Bybit's target wallet to initiate an operation. Two days later, Bybit's authorized personnel processed the transfer through the Safe interface and saw what appeared to be a normal internal transfer request.
But according to a reconstruction by security firm NCC Group, the transaction actually approved by the signers contained a malicious operation that invoked a contract pre-deployed by the attacker, changing the control logic of the cold wallet. After the transaction executed, the attacker no longer needed to obtain the original multi-signature again to transfer out the assets in the wallet. About $1.5 billion in assets then flowed out.
Schematic diagram of the Bybit theft process drawn by Curvegrid
According to Sygnia's investigation, the malicious code was removed about two minutes after the transaction occurred. The investigation concluded that the initial compromise of the Safe developer's computer may have involved social engineering, but the specific contact method has not yet been confirmed.
Bybit's multisignature setup required several authorized personnel to jointly approve transactions, which was originally intended to reduce the risk brought by the compromise of a single account. After the attackers entered Safe's cloud environment, they modified the web pages jointly used by these signers, ultimately causing malicious transactions to be approved.
In addition to breaching software service providers, some North Korean personnel have also been accused of using false identities to enter crypto companies. In 2025, the U.S. Department of Justice charged four North Korean citizens for participating in a theft scheme, two of whom were employed as developers at a blockchain company and a virtual token company respectively. Prosecutors said they used the job opportunities to steal and transfer more than $900,000 in virtual assets.
It is worth noting that traps may also be hidden on the other side of the recruitment process. After investigating an activity cluster it calls Sapphire Sleet, Microsoft found that attackers impersonate recruiters on social platforms, first discussing job opportunities with targets, then arranging technical interviews and requiring them to install malware disguised as meeting tools or developer tool updates. The job test received by the Ginco employee in the DMM case also appeared in a similar contact process.
These tactics are even continuing to evolve. In an October 2026 report, Microsoft pointed out that North Korea-related attackers have used generative AI to research targets, write contact content, and shape false identities. An invitation that appears carefully prepared for a job seeker's experience may be backed by the collection of information about their work background and social relationships.
Where did the stolen money go?
After transferring the assets away, attackers usually first split the funds across multiple new wallets. Some addresses, after receiving the money, transfer it onward in stages, leaving scattered on-chain records. The funds may then pass through decentralized exchanges or cross-chain services, be swapped into other tokens, or be moved to another blockchain. With each additional conversion, investigators must continue tracing new addresses and their counterparties.
The flow of funds after the Bybit theft provided a clue. In February 2025, the Ethereum stolen from Bybit began flowing to thousands of addresses. The attackers split and swapped the funds, then moved them through cross-chain services. TRM Labs said that within 48 hours, at least $160 million had been transferred and entered money-laundering channels.
While tracing these transfers, on-chain investigator ZachXBT noticed another group of people. According to his investigation published in October 2026, after the Bybit attack, more than a dozen accounts appeared in public Telegram and Discord groups seeking orders related to the stolen funds. One trader using the screen name Jimmy Green caught his attention.
ZachXBT decided to approach the other party as a client. On March 6, 2025, he transferred 349,700 USDC to a new address, preparing to conduct multiple transactions with Jimmy. Jimmy provided a receiving address and asked him to transfer USDC on the Ethereum chain in exchange for USDT on the Tron chain. ZachXBT traced and found that the wallet that paid the on-chain fees for this receiving address could be traced back to the funds stolen from Bybit and appeared on the public list of addresses involved in the case.
To continue contacting Jimmy, ZachXBT completed several more transactions with him, each incurring a loss of about 5%. The two talked about trading, as well as mahjong, food, and family. As their contact increased, Jimmy began telling the person he thought was a client about his team's business, including moving Bybit funds for North Korean clients and the team's operations in Hong Kong and mainland China.
ZachXBT said Jimmy once told him a day in advance that a sum of funds would be transferred to Solana, and the corresponding transfer appeared on-chain the next day. On March 12, Jimmy sent a screenshot of a cross-chain transaction. Based on the amount and time, ZachXBT found a matching order on THORChain. The three Solana addresses the other party subsequently provided helped him trace a set of Bybit stolen funds worth more than $12 million; according to him, Tether later froze 442,000 USDT related to this set of addresses.
Jimmy also claimed to ZachXBT that his team handled most of the stolen assets from Bybit. ZachXBT believes that the money-laundering pattern he observed is consistent with this claim. He handed his investigation findings to law enforcement personnel and private-sector investigators involved in the case, and only made the experience public in October 2026.
After the security incident, Binance announced that about $3 billion in assets related to the incident had been frozen on-chain. TRM Labs observed that the attackers sold some assets through decentralized exchanges and market makers, and also pledged some stolen assets in lending protocols such as Aave and JustLend to borrow other assets.
At the same time, Binance began replenishing the affected assets. On November 2, the platform said that about 95% of the relevant assets had been replenished and published proof of reserves for some major assets. On November 3, Binance announced further restoration of withdrawals for more assets and networks, and the security investigation is still ongoing.
