Value taken
USDValue taken in incidents publicly attributed to North Korea-linked actors in the selected period, valued at each attack block.
Dashboard · VantagePlanned
North Korea Crypto Hacks: Lazarus Group Theft Tracker
How much crypto have North Korea-linked hackers stolen, and how much do their attributed wallets still hold?
Thefts attributed to North Korea-linked groups, what their attributed wallets still hold and how the funds move across chains.
ShareEmail it
Blueprint
What the dashboard will show.
The dashboard as it will open in Vantage. Each figure is named here and arrives with its receipt; until its data is published, its place stays empty.
Thefts
Incidents attributed to North Korea-linked groups and the value taken.
Attributed incidents
countIncidents in the period with a public attribution to North Korea-linked actors.
Share of all hack losses
%Attributed losses as a share of all hack losses recorded for the same period.
Attributed addresses
countAddresses named by attributing sources, plus addresses that received funds directly from them.
Value taken by year
USDValue taken in attributed incidents per year, valued at each attack block.
Who was targeted
USDAttributed losses by type of victim: centralized exchanges, bridges, DeFi protocols, wallets and other crypto companies.
Every attributed incident
Each attributed incident with its date, victim, chain, amount taken, the attributing source and links to the attack transactions.
Attributed wallets
What the attributed addresses hold now and where their funds went.
Held by attributed wallets
USDValue held by attributed addresses at the latest day-end block, across every covered chain.
Frozen by issuers
USDStablecoins frozen by their issuers at attributed addresses, from the issuers' freeze events.
Where the funds went
USDValue sent from attributed addresses each month, split by destination: bridges, swap protocols, mixers, exchanges and unlabelled addresses.
- Period
- This year, any past year or all time
- Attributed group
- Every group name used by the attributing sources
About
What it answers, and for whom.
Groups linked to North Korea are behind some of the largest thefts in crypto, according to public attributions by law enforcement, including the FBI. This dashboard adds up the incidents those sources attribute to them and follows the addresses they name: what those wallets still hold, and where the rest of the funds went.
Attribution is not something a blockchain can prove. Each incident and address here carries the advisory, sanctions designation or post-mortem that attributes it, and the dashboard counts only what such a source names, plus funds that moved directly from those addresses. The amounts, balances and transfers are then read from the chains, each with its block and transaction.
Published investigations describe a recurring laundering pattern: stolen tokens swapped into liquid assets such as ETH, moved through bridges and cross-chain swap protocols, often into bitcoin, then split across many fresh addresses before reaching brokers or exchanges. The wallets page shows how much value took each path.
Method
How it will be measured.
Every figure will be read at a block, kept with its source and its exact read, and open a receipt anyone can re-check.
How receipts work →- Incidents and addresses enter only when a public source attributes them to North Korea-linked actors, such as an FBI advisory or a US Treasury sanctions designation; the source is stored with each one.
- Native and token balances of every attributed address are read at the last block of each day on each chain where the address holds funds.
- Outgoing transfers from attributed addresses are followed to labelled bridges, swap routers, mixers and exchange deposit addresses, one hop at a time and only while the path is unambiguous.
- Stolen amounts are valued at oracle or DEX pool prices at each attack block; current holdings are valued at the latest day-end price.
The data it needs
Chain data, with some off-chain sources
- security_incidentsTo buildHacks and exploitsA registry of exploits, hacks and rug pulls: date, chain, protocol, attack type, amount lost and the transactions involved.
- address_labelsTo buildAddress labelsLabels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers.
- stablecoin_freezesTo buildStablecoin freezes and blacklistsAddresses frozen or blacklisted by stablecoin issuers, the balances frozen, and later unfreezes or destroyed funds, per stablecoin and chain.
- native_prices_dailyTo buildOracle prices by dayReference prices of major assets read from on-chain oracle feeds (Chainlink latestRoundData) at each day's last block, with each round's update time.
- FBI advisories, US Treasury sanctions designations and post-mortems that name attributed addresses, recorded with their date and link
- Native, ERC-20 and TRC-20 balances of attributed addresses at day-end blocks
- Outbound Transfer logs and traces from attributed addresses to bridge routers, swap routers and exchange deposit addresses
- Bitcoin outputs received by addresses where bridged proceeds arrive, and their later spends
- Oracle and DEX pool prices at each attack block and at day end
Questions
Questions people ask.
What is the Lazarus Group?
Lazarus Group is the name the US Treasury and security researchers use for a North Korean state-sponsored hacking group; related clusters are tracked under other names, such as TraderTraitor in FBI advisories. Public sources attribute many large exchange and bridge thefts to these groups.
How much crypto has North Korea stolen?
The headline figure on this dashboard adds up every incident a public source attributes to North Korea-linked actors, valued at each attack block. Totals published by different organizations differ because they attribute different incidents, so each incident counted here lists its source.
What is TraderTraitor?
TraderTraitor is the name the FBI uses for a North Korean cyber actor cluster, linked to the Lazarus Group, that it has named in advisories about thefts from exchanges and other crypto companies, including the Bybit theft of February 2025.
How do North Korean hackers launder stolen crypto?
Published investigations describe swaps into liquid assets, bridges and cross-chain swap protocols, mixers and many hops through fresh addresses before funds reach brokers or exchanges. The wallets page measures how much value attributed addresses sent through each kind of service.
Can funds in attributed wallets be frozen?
Tokens with an issuer freeze function, such as USDT and USDC, can be frozen at an attacker's address, and exchanges can freeze deposits they receive. Native assets such as ETH and BTC cannot be frozen by any issuer, which is one reason attackers swap into them quickly.
- Attribution
- A public statement by law enforcement, a sanctions authority or an investigator that links an incident or an address to a specific actor.
- SDN list
- The US Treasury's Specially Designated Nationals list, whose entries can include crypto addresses tied to sanctioned groups.
- Peel chain
- A laundering pattern in which a large balance moves through a long series of addresses, each sending a small part away.
Related
More apps like this.
Stolen Crypto Tracker: Where Hacked Funds Went
Follow a hack's stolen funds hop by hop into bridges, swap protocols, mixers and exchanges, or see what still sits in attacker wallets.
Multi-chainCrypto Hack Tracker: Exploits and Losses This Year
Every major hack and exploit of the year with the amount taken, how the attackers got in and where the stolen funds sit now.
Multi-chainCrypto Exchange Hacks: Full List and Losses
Every known centralized exchange breach, when it happened, which wallets were hit and how much left them, tied to the on-chain outflows.
Multi-chainBiggest Crypto Hacks of All Time, Ranked
The largest hacks and exploits on record, ranked by value taken at the time, with the attack type, the chain and how much came back.
Multi-chainCrypto Address Checker: Flagged, Sanctioned or Hacked
Check an address before you send or accept funds: direct flags and one-hop links to sanctioned, frozen, hacked or phishing addresses.
Multi-chainEthereumTron+1Bitcoin Quantum Risk: BTC in Exposed Public Key Addresses
Bitcoin held in outputs whose public keys are already visible on-chain, split by script type and tracked day by day.
BitcoinBuild North Korea Crypto Hacks: Lazarus Group Theft Tracker on verified data.
Start free in Voltfin Studio: boards, tables and reports where every number opens its receipt. Tell us which data you need first and we will build it next.