North Korean Lazarus Group amasses over $40M in Bitcoin, data reveals

North Korean hacking collective Lazarus Group holds a whopping $47 million in cryptocurrency, most of which is in Bitcoin BTC$62,970, new data shows.

According to data collated on Dune Analytics from 21.co, the parent company of 21Shares, wallets associated with the Lazarus Group currently hold around $47 million worth of digital assets, including $42.5 million in BTC, $1.9 million in Ether ETH$2,470.87, $1.1 million in BNB BNB$576.84 and an additional $640,000 in stablecoins, primarily Binance USD BUSD.

However, the amount of crypto held appears to have dropped from the $86 million the group held on Sept. 6, a few days after the Stake.com hack in which Lazarus was implicated.

The Dune dashboard tracks 295 wallets identified by the United States Federal Bureau of Investigation (FBI) and Office of Foreign Assets Control (OFAC) as being owned by the hacking group, it noted.

Surprisingly, the group does not hold any privacy coins, such as Monero XMR$152.73, Dash DASH$23.96 or Zcash ZEC$34.63, which are arguably much harder to trace.

Meanwhile, Lazarus crypto wallets are still highly active, with the most recent transaction being recorded on Sept. 20.

21.co also noted that the group’s holdings are likely to be much higher than what has been reported. “We should note that this is a lower-bound estimation of Lazarus Group’s crypto holdings based on publicly available information,” it stated.

On Sept. 13, Cointelegraph reported that Lazarus Group carried out the attack on crypto exchange CoinEx, which lost at least $55 million.

The FBI has also pointed the finger at Lazarus for the Alphapo, CoinsPaid and Atomic Wallet hacks, which collectively added up to more than $200 million that the group stole in 2023.

However, Chainalysis reported that crypto thefts by North Korea-linked hackers are down a whopping 80% from 2022. As of mid-September, North Korea-linked groups had stolen a total of $340.4 million in crypto, down from a record $1.65 billion in pilfered digital assets in 2022.

Late last week, U.S. federal authorities warned of “significant risk” for potential attacks on U.S. healthcare and public health sector entities by Lazarus Group.