Loading story…
U.S. authorities attributed the theft from the Ronin Network bridge used by the Axie Infinity ecosystem to North Korea-linked actors, identifying Lazarus Group and APT38 as responsible for one of the largest cryptocurrency heists on record. The breach drained roughly $540 million to $615 million in ETH and USDC, and the U.S. Treasury’s Office of Foreign Assets Control sanctioned an Ethereum address tied to the operation. The case reinforced longstanding warnings that DPRK-backed cyber units are using large-scale cryptocurrency theft to generate revenue outside the formal financial system.
Blockchain investigators reported that the stolen assets were laundered in stages, with attackers converting USDC into ETH through decentralized exchanges before routing funds through Tornado Cash to hinder tracing and evade token freezes, AML screening, and KYC controls at centralized exchanges. Researchers and law enforcement said the Ronin theft fit a broader pattern of North Korean crypto operations that had expanded from targeting centralized exchanges to attacking DeFi platforms and cross-chain bridges, while later recovery efforts showed that coordinated action by the crypto community could make cashing out stolen funds more difficult.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Chainalysis reported that law enforcement had seized a portion of the cryptocurrency stolen in the Ronin hack. The recovery demonstrated that some of the laundered proceeds could still be traced and clawed back despite the attackers' use of mixers.
TRM Labs reported additional movement of stolen Ronin funds through Tornado Cash, documenting continued laundering activity by Lazarus-linked actors. The update showed the attackers were still attempting to obfuscate the proceeds weeks after the theft.
The FBI publicly stated that Lazarus Group and APT38, both associated with North Korea, were responsible for the theft from the Axie Infinity/Ronin ecosystem. The announcement reinforced U.S. government attribution of the heist to DPRK-linked threat actors.
The U.S. Treasury's OFAC attributed the Ronin theft to North Korea's Lazarus Group and sanctioned an Ethereum address tied to the stolen funds. This marked a formal U.S. government attribution of the attack to DPRK-linked actors.
Blockchain analysts reported that the attackers started laundering portions of the stolen funds by converting USDC to ETH via decentralized exchanges and routing ETH through Tornado Cash. Researchers said this approach was intended to reduce the risk of token freezes and evade AML/KYC controls at centralized exchanges.
Attackers compromised the Ronin bridge used by Axie Infinity and stole roughly $540 million in ETH and USDC, making it one of the largest DeFi thefts at the time. The theft was later widely cited as approximately $615 million based on subsequent valuation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
chainalysis.com
Open sourcetechtarget.com
Open sourcetrmlabs.com
Open sourcebbc.com
Open sourceelliptic.co
Open sourcetherecord.media
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The United States has tied North Korea’s **Lazarus Group** and related DPRK cyber operators to a long-running campaign of financially motivated intrusions, sanctions evasion, and destructive attacks, describing the activity as a revenue source for Pyongyang’s weapons programs. U.S. government advisories and enforcement actions link the regime-backed operators—also tracked as **HIDDEN COBRA**—to major incidents including the **Sony Pictures** attack, the **Bangladesh Bank SWIFT** theft, **WannaCry 2.0**, **FASTCash** ATM cash-out operations, and repeated compromises of cryptocurrency businesses and exchanges. Treasury, DOJ, and FBI actions have named and charged North Korean operatives and their facilitators, including sanctions on individuals accused of supporting Lazarus and laundering stolen virtual assets. U.S. authorities said Lazarus stole hundreds of millions of dollars from the **Ronin** network tied to Axie Infinity, while other cases alleged more than **$100 million** in cryptocurrency laundering tied to exchange hacks. Officials said the campaign has generated billions in illicit proceeds and warned that financial institutions, crypto firms, and infrastructure operators face continued risk from DPRK-linked theft, money laundering, extortion, and related cyber activity.
Aug 15, 2026
Crypto exchange **Bybit** lost about **$1.5 billion** in Ethereum-linked assets after attackers compromised the platform in what has been described as the largest cryptocurrency theft on record. Blockchain investigators at TRM Labs and a subsequent **FBI/IC3** public attribution linked the operation to North Korean threat actors, citing wallet overlaps and tradecraft consistent with earlier DPRK-backed campaigns. Reporting tied the theft to a broader pattern of financially motivated North Korean operations that have previously targeted major crypto platforms and financial institutions. After the theft, the stolen funds were moved at high speed through intermediary wallets, decentralized exchanges, and cross-chain bridges, with a large share ultimately converted into **Bitcoin**. Analysts said the laundering operation showed an evolution in DPRK tactics away from reliance on traditional mixers and toward rapid, high-volume cross-chain obfuscation; later reporting said more than **$1 billion** had been laundered within months. The heist also triggered recovery efforts, including Bybit's **10% bounty** program for frozen or recovered assets, and intensified debate over cryptocurrency oversight and the implications for future U.S. regulation.
Jun 29, 2026
The U.S. Department of Justice unsealed charges against three alleged North Korean military hackers tied to the Reconnaissance General Bureau, identifying them as members of the **Lazarus Group/APT38** behind a years-long campaign of cyberattacks and financial crime. Prosecutors linked the defendants to the 2014 **Sony Pictures** intrusion, SWIFT-enabled bank theft attempts including the Bangladesh Bank case, **FASTCash** ATM cash-out operations, the **WannaCry 2.0** ransomware outbreak, spear-phishing, and the **AppleJeus** cryptocurrency malware scheme. Authorities said the operations targeted banks, cryptocurrency businesses, and other organizations worldwide, with attempted thefts and losses totaling roughly **$1.3 billion**. Security and law-enforcement reporting described a broad Lazarus toolkit used across those operations, including malware such as **Trojan.Banswift**, **Backdoor.Contopee**, **Downloader.Ratankba**, **Trojan.Fastcash**, and AppleJeus variants, while WannaCry was noted to have spread via **EternalBlue** against Windows flaws including `CVE-2017-0144` and `CVE-2017-0145`. The case also connected North Korean operators to laundering networks and later cryptocurrency theft activity, including the FBI’s attribution of the **$100 million Harmony Horizon Bridge** theft to Lazarus and its **TraderTraitor** campaign. U.S. authorities said they seized about **$1.9 million** in stolen cryptocurrency, issued victim notifications and joint guidance, and continued efforts to trace and freeze assets used to fund Pyongyang’s weapons programs.
Aug 15, 2026