# North Korea Crypto Hacks: Lazarus Group Theft Tracker

> North Korea crypto hacks in one tracker: thefts attributed to Lazarus Group and TraderTraitor, the balances of attributed wallets and their laundering routes.

Markdown copy of https://voltfincrypto.com/apps/north-korea-crypto-hacks-tracker

**Question:** How much crypto have North Korea-linked hackers stolen, and how much do their attributed wallets still hold?

- Kind: Dashboard in Voltfin Vantage
- Topic: [Security and risk](https://voltfincrypto.com/topics/security)
- Chains: Multi-chain, Ethereum, Bitcoin
- Status: Planned. The data is not published yet, so this page states no figure; each figure will open its receipt when it is.

Groups linked to North Korea are behind some of the largest thefts in crypto, according to public attributions by law enforcement, including the FBI. This dashboard adds up the incidents those sources attribute to them and follows the addresses they name: what those wallets still hold, and where the rest of the funds went.

Attribution is not something a blockchain can prove. Each incident and address here carries the advisory, sanctions designation or post-mortem that attributes it, and the dashboard counts only what such a source names, plus funds that moved directly from those addresses. The amounts, balances and transfers are then read from the chains, each with its block and transaction.

Published investigations describe a recurring laundering pattern: stolen tokens swapped into liquid assets such as ETH, moved through bridges and cross-chain swap protocols, often into bitcoin, then split across many fresh addresses before reaching brokers or exchanges. The wallets page shows how much value took each path.

## Blueprint

### Thefts

Incidents attributed to North Korea-linked groups and the value taken.

- **Value taken** (USD): Value taken in incidents publicly attributed to North Korea-linked actors in the selected period, valued at each attack block.
- **Attributed incidents** (count): Incidents in the period with a public attribution to North Korea-linked actors.
- **Share of all hack losses** (%): Attributed losses as a share of all hack losses recorded for the same period.
- **Attributed addresses** (count): Addresses named by attributing sources, plus addresses that received funds directly from them.
- **Value taken by year** (USD): Value taken in attributed incidents per year, valued at each attack block.
- **Who was targeted** (USD): Attributed losses by type of victim: centralized exchanges, bridges, DeFi protocols, wallets and other crypto companies.
- **Every attributed incident**: Each attributed incident with its date, victim, chain, amount taken, the attributing source and links to the attack transactions.

### Attributed wallets

What the attributed addresses hold now and where their funds went.

- **Held by attributed wallets** (USD): Value held by attributed addresses at the latest day-end block, across every covered chain.
- **Frozen by issuers** (USD): Stablecoins frozen by their issuers at attributed addresses, from the issuers' freeze events.
- **Where the funds went** (USD): Value sent from attributed addresses each month, split by destination: bridges, swap protocols, mixers, exchanges and unlabelled addresses.

Filters: Period (This year, any past year or all time); Attributed group (Every group name used by the attributing sources).

## How it will be measured

- Incidents and addresses enter only when a public source attributes them to North Korea-linked actors, such as an FBI advisory or a US Treasury sanctions designation; the source is stored with each one.
- Native and token balances of every attributed address are read at the last block of each day on each chain where the address holds funds.
- Outgoing transfers from attributed addresses are followed to labelled bridges, swap routers, mixers and exchange deposit addresses, one hop at a time and only while the path is unambiguous.
- Stolen amounts are valued at oracle or DEX pool prices at each attack block; current holdings are valued at the latest day-end price.

## Data it needs

- `security_incidents` (to build): A registry of exploits, hacks and rug pulls: date, chain, protocol, attack type, amount lost and the transactions involved.
- `address_labels` (to build): Labels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers.
- `stablecoin_freezes` (to build): Addresses frozen or blacklisted by stablecoin issuers, the balances frozen, and later unfreezes or destroyed funds, per stablecoin and chain.
- `native_prices_daily` (to build): Reference prices of major assets read from on-chain oracle feeds (Chainlink latestRoundData) at each day's last block, with each round's update time.
- Source: FBI advisories, US Treasury sanctions designations and post-mortems that name attributed addresses, recorded with their date and link
- Source: Native, ERC-20 and TRC-20 balances of attributed addresses at day-end blocks
- Source: Outbound Transfer logs and traces from attributed addresses to bridge routers, swap routers and exchange deposit addresses
- Source: Bitcoin outputs received by addresses where bridged proceeds arrive, and their later spends
- Source: Oracle and DEX pool prices at each attack block and at day end

## Questions

### What is the Lazarus Group?

Lazarus Group is the name the US Treasury and security researchers use for a North Korean state-sponsored hacking group; related clusters are tracked under other names, such as TraderTraitor in FBI advisories. Public sources attribute many large exchange and bridge thefts to these groups.

### How much crypto has North Korea stolen?

The headline figure on this dashboard adds up every incident a public source attributes to North Korea-linked actors, valued at each attack block. Totals published by different organizations differ because they attribute different incidents, so each incident counted here lists its source.

### What is TraderTraitor?

TraderTraitor is the name the FBI uses for a North Korean cyber actor cluster, linked to the Lazarus Group, that it has named in advisories about thefts from exchanges and other crypto companies, including the Bybit theft of February 2025.

### How do North Korean hackers launder stolen crypto?

Published investigations describe swaps into liquid assets, bridges and cross-chain swap protocols, mixers and many hops through fresh addresses before funds reach brokers or exchanges. The wallets page measures how much value attributed addresses sent through each kind of service.

### Can funds in attributed wallets be frozen?

Tokens with an issuer freeze function, such as USDT and USDC, can be frozen at an attacker's address, and exchanges can freeze deposits they receive. Native assets such as ETH and BTC cannot be frozen by any issuer, which is one reason attackers swap into them quickly.

## Glossary

- **Attribution**: A public statement by law enforcement, a sanctions authority or an investigator that links an incident or an address to a specific actor.
- **SDN list**: The US Treasury's Specially Designated Nationals list, whose entries can include crypto addresses tied to sanctioned groups.
- **Peel chain**: A laundering pattern in which a large balance moves through a long series of addresses, each sending a small part away.

## Related apps

- [Stolen Crypto Tracker: Where Hacked Funds Went](https://voltfincrypto.com/apps/stolen-crypto-tracker)
- [Crypto Hack Tracker: Exploits and Losses This Year](https://voltfincrypto.com/apps/crypto-hack-tracker)
- [Crypto Exchange Hacks: Full List and Losses](https://voltfincrypto.com/apps/crypto-exchange-hacks-list)
- [Biggest Crypto Hacks of All Time, Ranked](https://voltfincrypto.com/apps/biggest-crypto-hacks)
- [Crypto Address Checker: Flagged, Sanctioned or Hacked](https://voltfincrypto.com/apps/crypto-address-checker)
- [Bitcoin Quantum Risk: BTC in Exposed Public Key Addresses](https://voltfincrypto.com/apps/bitcoin-quantum-risk-exposed-keys)

Build it in Voltfin Studio: https://app.voltfincrypto.com/signup?next=%2F