Inside the Lazarus Group’s Money Laundering Strategy

How Lazarus Group Moves Stolen Crypto

The Lazarus Group, a North Korean hacking collective, has once again deployed its sophisticated money laundering techniques following the $1.5 billion Bybit hack. Recent findings from Nansen and Chainalysis reveal their key strategies:

Swapping Assets – Stolen, illiquid tokens are quickly exchanged for more liquid assets, like Ethereum (ETH), making them easier to transfer.
Creating a Complex Trail – Funds move through multiple wallets, decentralized exchanges, and cross-chain bridges to obscure the money’s origins.
Avoiding Scrutiny – Some stolen funds are left untouched in dormant wallets, allowing public attention to fade before further laundering.

Breaking Down the Laundering Process

1. Converting Stolen Assets

The hacker first swapped at least $200 million in staked tokens for ETH.
This conversion makes the stolen funds easier to move on blockchain networks.

2. Obfuscating Transactions

Funds are routed through a maze of intermediate wallets to hide their origin.
Decentralized exchanges (DEXs) and cross-chain bridges are used for laundering, avoiding platforms that require identity verification (KYC).
Some stolen ETH is swapped for Bitcoin (BTC) and stablecoins like Dai (DAI).
Certain platforms, such as Chainflip, have identified and blocked laundering attempts in real time.

3. Splitting the Funds

Initially, stolen assets were divided across 42 wallets.
In a second stage, they were further dispersed into thousands of wallets to make tracking harder.

4. The “Sit and Wait” Strategy

Over $900 million remains untouched in various wallets.
The group delays transactions to avoid heightened scrutiny after high-profile hacks.

Lazarus Group’s Biggest Heist Yet

The Bybit hack is the largest crypto theft in history.
It exceeds the group’s total haul for 2024 ($1.3 billion across 47 attacks).
As pressure from regulators and cybersecurity experts grows, Lazarus Group continues to evolve its tactics, making crypto security more critical than ever.