Lazarus Moves 121.5 BTC: The North Korean Laundering Machine is Still Running

A transfer, not a hack. Lookonchain has detected the transfer of 121.5 BTC, approximately $7.74 million at the time of the operation, from an address attributed to Lazarus Group to two unidentified wallets. However, this on-chain movement does not reveal either the ultimate owner of the funds or their destination. The amount remains modest compared to the over $6 billion in cryptocurrencies that North Korea-linked groups are believed to have stolen since 2017. Nonetheless, it serves as a reminder that Pyongyang continues to move old loot under the constant watch of blockchain analysts.

Key Points

• Lookonchain identified a unique transfer of 121.5 BTC, about $7.74 million, from an address attributed to Lazarus Group.
• The North Korean circuit follows four steps: conversion to bitcoin, splitting the loot, passing through mixers, and cashing out via Chinese OTC desks.
• Two attacks in April, Drift Protocol ($285 million) and KelpDAO ($292 million), account for 90% of North Korean revenues for the semester.
• With bitcoin at around $64,000, half of the peak in October 2025, the stock diverted by Pyongyang is losing value during the laundering process.

121.5 BTC Moved by Lazarus, but No Origin Established Yet

According to Lookonchain, the 121.5 BTC have thus left an address labeled as belonging to Lazarus Group to join two new addresses. The attribution relies on transaction history and address clustering conducted by on-chain analysis firms. It constitutes a solid set of clues but not judicial proof of ownership.

Moreover, nothing at this stage allows linking these bitcoins to a specific hack. Their transfer may correspond to internal redistribution, a laundering phase, or preparation for conversion. Claiming they originate from the attacks on Drift Protocol or KelpDAO would therefore be speculative.

The method employed by North Korean groups is, however, well documented. After a theft, assets are generally converted into liquid cryptocurrencies, distributed among numerous addresses, and then moved between blockchains, exchanges, and sometimes mixers. The goal is to multiply intermediaries to complicate the work of investigators.

The last link often remains the conversion to fiat currencies. In 2020, the U.S. Treasury notably sanctioned Tian Yinyin and Li Jiadong, two Chinese nationals accused of laundering cryptocurrencies from a hack attributed to Lazarus Group. The OFAC already described the role of Chinese intermediaries in the outflow of funds.

North Korea Still Concentrates the Largest Bitcoin and Crypto Thefts

This transfer comes after a first semester dominated by two attacks attributed to North Korean actors. According to TRM Labs, Drift Protocol lost about $285 million on April 1, followed by KelpDAO losing $292 million on April 18.

Together, these incidents represent $577 million. TRM estimates that groups linked to Pyongyang have diverted about $643 million in the first half of 2026, accounting for 66% of the $972 million stolen across the entire ecosystem. The company, however, recorded 207 attacks during the period, with a median loss limited to $219,000: North Korea strikes less often than opportunistic hackers but targets infrastructures capable of releasing hundreds of millions.

TRM's Beacon Network now brings together more than 70 platforms and protocols capable of quickly sharing addresses associated with attackers. This cooperation accelerates freezes, without eliminating the problem: a blockchain allows tracking funds but not always identifying the intermediary who ultimately converts them.

The transfer of 121.5 BTC has hardly affected the price of bitcoin, which remains close to $64,000. Its significance lies elsewhere: each movement exposes a new segment of Lazarus's financial circuit, up to the point where the funds will eventually leave the blockchain.