Loading story…
The United States has tied North Korea’s Lazarus Group and related DPRK cyber operators to a long-running campaign of financially motivated intrusions, sanctions evasion, and destructive attacks, describing the activity as a revenue source for Pyongyang’s weapons programs. U.S. government advisories and enforcement actions link the regime-backed operators—also tracked as HIDDEN COBRA—to major incidents including the Sony Pictures attack, the Bangladesh Bank SWIFT theft, WannaCry 2.0, FASTCash ATM cash-out operations, and repeated compromises of cryptocurrency businesses and exchanges.
Treasury, DOJ, and FBI actions have named and charged North Korean operatives and their facilitators, including sanctions on individuals accused of supporting Lazarus and laundering stolen virtual assets. U.S. authorities said Lazarus stole hundreds of millions of dollars from the Ronin network tied to Axie Infinity, while other cases alleged more than $100 million in cryptocurrency laundering tied to exchange hacks. Officials said the campaign has generated billions in illicit proceeds and warned that financial institutions, crypto firms, and infrastructure operators face continued risk from DPRK-linked theft, money laundering, extortion, and related cyber activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
18 events from the most recent confirmed update back to the earliest known activity.
The U.S. Treasury announced sanctions on individuals accused of laundering cryptocurrency for the Lazarus Group. The action reflected continued U.S. efforts to disrupt financial support networks for DPRK-linked cybercrime.
The U.S. Treasury sanctioned four entities and one individual for supporting North Korea’s malicious cyber operations and fraudulent overseas IT worker schemes. The action targeted organizations tied to the Reconnaissance General Bureau, including the Technical Reconnaissance Bureau, the 110th Research Center, Pyongyang University of Automation, Chinyong Information Technology Cooperation Company, and DPRK national Kim Sang Man.
The U.S. Department of Justice later charged Sim with conspiracy related to work with OTC traders, according to the report on the sanctions action. The charge was presented as an additional legal step connected to laundering support for Lazarus-linked activity.
The U.S. Treasury sanctioned three North Koreans for supporting the Lazarus Group, which it said is controlled by North Korea’s Reconnaissance General Bureau and has conducted a multibillion-dollar campaign against the cryptocurrency sector. The action highlighted allegations that stolen crypto proceeds help fund North Korea’s weapons program.
The Departments of State, Treasury, and Homeland Security, along with the FBI, issued a joint advisory describing DPRK as a significant state-sponsored cyber threat to critical infrastructure and the international financial system. The advisory publicly tied North Korea to operations including Sony, Bangladesh Bank, WannaCry, FASTCash, and exchange thefts.
A March 2020 Department of Justice forfeiture complaint alleged that North Korean cyber actors used North Korean infrastructure to hack digital currency exchanges, steal hundreds of millions of dollars in digital currency, and launder the proceeds. The complaint added legal detail to prior public allegations about DPRK crypto theft.
The UN Security Council 1718 Committee Panel of Experts’ 2019 mid-term report said it was investigating dozens of suspected DPRK cyber-enabled heists and that, as of late 2019, North Korea had attempted to steal as much as $2 billion. The report also described increasingly sophisticated laundering and theft operations.
The U.S. Treasury announced sanctions targeting North Korea for multiple cyber-attacks. The action accompanied broader U.S. efforts to impose consequences for DPRK-linked cyber operations.
The U.S. Department of Justice announced charges against a North Korean regime-backed programmer for conspiracy to conduct multiple cyber attacks and intrusions. The case tied together activity including major DPRK-linked operations.
In April 2018, DPRK state-sponsored cyber actors allegedly hacked a digital currency exchange and stole nearly $250 million in digital currency. The stolen assets were allegedly laundered through hundreds of automated transactions to obscure their origin.
In one 2018 FASTCash incident, DPRK cyber actors enabled simultaneous ATM withdrawals in 23 countries. The event was cited by U.S. authorities as part of North Korea’s ongoing financial theft operations.
In May 2017, WannaCry 2.0 infected hundreds of thousands of computers across more than 150 countries, affecting hospitals, schools, businesses, and homes. The ransomware encrypted victims’ data and demanded payment in Bitcoin.
In one 2017 FASTCash incident, DPRK cyber actors enabled simultaneous ATM withdrawals in more than 30 countries. The operation demonstrated the scale of the bank payment-switch compromise technique.
In February 2016, DPRK state-sponsored cyber actors allegedly attempted to steal at least $1 billion from financial institutions worldwide and succeeded in stealing $81 million from Bangladesh Bank. The operation used spear-phishing, compromised SWIFT-connected systems, and fraudulent authenticated transfer messages.
Since late 2016, DPRK state-sponsored cyber actors have used the FASTCash scheme to steal tens of millions of dollars from ATMs in Asia and Africa. The scheme remotely compromises banks’ payment switch application servers to enable fraudulent withdrawals.
The FBI issued an update on the Sony investigation identifying the North Korean government as responsible for the intrusion. This marked a formal U.S. law enforcement attribution of the attack.
In November 2014, DPRK state-sponsored cyber actors allegedly attacked Sony Pictures Entertainment in retaliation for the film “The Interview.” The attack involved theft of confidential data, threats to executives and employees, and damage to thousands of computers.
The Lazarus Group was identified as being behind the theft of $625 million in digital assets from the Ronin network tied to the Axie Infinity game. The theft was described as the largest-ever crypto heist.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
home.treasury.gov
Open sourcehome.treasury.gov
Open sourcecoindesk.com
Open sourceus-cert.gov
Open sourceofac.treasury.gov
Open sourceofac.treasury.gov
Open sourceofac.treasury.gov
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Justice unsealed charges against three alleged North Korean military hackers tied to the Reconnaissance General Bureau, identifying them as members of the **Lazarus Group/APT38** behind a years-long campaign of cyberattacks and financial crime. Prosecutors linked the defendants to the 2014 **Sony Pictures** intrusion, SWIFT-enabled bank theft attempts including the Bangladesh Bank case, **FASTCash** ATM cash-out operations, the **WannaCry 2.0** ransomware outbreak, spear-phishing, and the **AppleJeus** cryptocurrency malware scheme. Authorities said the operations targeted banks, cryptocurrency businesses, and other organizations worldwide, with attempted thefts and losses totaling roughly **$1.3 billion**. Security and law-enforcement reporting described a broad Lazarus toolkit used across those operations, including malware such as **Trojan.Banswift**, **Backdoor.Contopee**, **Downloader.Ratankba**, **Trojan.Fastcash**, and AppleJeus variants, while WannaCry was noted to have spread via **EternalBlue** against Windows flaws including `CVE-2017-0144` and `CVE-2017-0145`. The case also connected North Korean operators to laundering networks and later cryptocurrency theft activity, including the FBI’s attribution of the **$100 million Harmony Horizon Bridge** theft to Lazarus and its **TraderTraitor** campaign. U.S. authorities said they seized about **$1.9 million** in stolen cryptocurrency, issued victim notifications and joint guidance, and continued efforts to trace and freeze assets used to fund Pyongyang’s weapons programs.
Aug 15, 2026
U.S. authorities attributed the theft from the Ronin Network bridge used by the **Axie Infinity** ecosystem to North Korea-linked actors, identifying **Lazarus Group** and **APT38** as responsible for one of the largest cryptocurrency heists on record. The breach drained roughly **$540 million to $615 million** in **ETH** and **USDC**, and the U.S. Treasury’s Office of Foreign Assets Control sanctioned an Ethereum address tied to the operation. The case reinforced longstanding warnings that DPRK-backed cyber units are using large-scale cryptocurrency theft to generate revenue outside the formal financial system. Blockchain investigators reported that the stolen assets were laundered in stages, with attackers converting **USDC** into **ETH** through decentralized exchanges before routing funds through **Tornado Cash** to hinder tracing and evade token freezes, AML screening, and KYC controls at centralized exchanges. Researchers and law enforcement said the Ronin theft fit a broader pattern of North Korean crypto operations that had expanded from targeting centralized exchanges to attacking DeFi platforms and cross-chain bridges, while later recovery efforts showed that coordinated action by the crypto community could make cashing out stolen funds more difficult.
Jun 29, 2026
North Korean state-sponsored threat actors, including the Lazarus Group and Kimsuky, have been responsible for a dramatic surge in global cryptocurrency theft in 2025, stealing at least $2.02 billion—over half of the total $3.4 billion stolen worldwide. The February compromise of the Bybit cryptocurrency exchange accounted for $1.5 billion of these losses, with the attack attributed to the TraderTraitor cluster, and further links established through malware infrastructure analysis. Lazarus Group, affiliated with North Korea's Reconnaissance General Bureau, has also been implicated in the theft of $36 million from Upbit and is estimated to have stolen over $6.75 billion cumulatively through a series of high-profile heists and campaigns. Recent collaborative research by Hunt.io and the Acronis Threat Research Unit has uncovered new operational infrastructure used by both Lazarus and Kimsuky across global campaigns. The investigation revealed active tool-staging servers, credential theft environments, and tunneling nodes, highlighting the interconnected nature of DPRK cyber operations. Despite evolving malware and tactics, these groups consistently reuse infrastructure, making their activities traceable across campaigns. The findings provide defenders with actionable intelligence on the infrastructure patterns and operational habits of North Korean threat actors, supporting efforts to detect and disrupt ongoing and future attacks.
Jun 29, 2026