Lazarus Group

Overview

Lazarus Group is not a company you can look up in a registry. It is the name U.S. government agencies and cybersecurity researchers use for a cluster of hacking operations they attribute to North Korea — specifically to units of the Reconnaissance General Bureau, the country’s military intelligence agency (U.S. DOJ). In a federal indictment unsealed in February 2021, the Justice Department accused three alleged North Korean programmers — Jon Chang Hyok, Kim Il, and Park Jin Hyok — of conspiring to steal and extort more than $1.3 billion through bank heists, ransomware, and cryptocurrency theft, identifying their units as the groups the industry calls Lazarus Group and APT38 (U.S. DOJ).

The name entered public use in February 2016, when an industry consortium led by security firm Novetta released its “Operation Blockbuster” report naming the Lazarus Group as the actor behind the November 2014 attack on Sony Pictures Entertainment — which the FBI had already attributed to North Korea (iTnews). Since then the label has become shorthand for what the U.S. government describes as a uniquely profit-driven state operation: the attributed campaigns exist to generate foreign currency for the regime, including weapons-program funding — a U.N. Panel of Experts report estimated about $3 billion stolen in 58 suspected North Korean crypto heists from 2017 to 2023 (UN reporting via btcpolitan).

The many names of one attributed operation

“Hidden Cobra” is the U.S. government’s own designation; “Lazarus Group” is the industry’s umbrella term, coined by Novetta’s consortium; and APT38, BlueNorOff, TraderTraitor, and BeagleBoyz name subgroups or campaign clusters for particular operation types (CISA AA20-239A; U.S. DOJ). CISA’s 2020 advisory says BeagleBoyz is “a subset of HIDDEN COBRA activity” overlapping with the groups vendors track as Lazarus, APT38, Bluenoroff, and Stardust Chollima (CISA AA20-239A). Even the DOJ indictment reflects the split: the programmers worked in units “known by multiple names in the cybersecurity community, including Lazarus Group and Advanced Persistent Threat 38 (APT38)” (U.S. DOJ).

In short: a “Lazarus” attack, an “APT38” heist, a “TraderTraitor” theft, or a “BeagleBoyz” bank robbery are usually different windows into the same attributed operation, not rival gangs — the names were coined by different analysts for different purposes. That fog is also a real risk: any “Lazarus” label on a wallet can look authoritative while being wrong, as the 2025 World Liberty Financial dispute showed.

Operations the U.S. government attributes to Lazarus

The 2021 DOJ indictment catalogued a single alleged conspiracy spanning destruction and theft (U.S. DOJ). Its alleged schemes included the destructive November 2014 attack on Sony Pictures Entertainment in retaliation for the film The Interview, the targeting of AMC Theatres which was scheduled to show the film, and a 2015 intrusion into the British production company Mammoth Screen (U.S. DOJ). On the financial side, the indictment alleged SWIFT-message fraud attempts from 2015 through 2019 targeting banks in Vietnam, Bangladesh, Taiwan, Mexico, Malta, and Africa — attempts to steal more than $1.2 billion — plus the creation of the destructive WannaCry 2.0 ransomware in May 2017, and a fraudulent Marine Chain Token sold in 2017–2018 to secretly funnel funds to North Korea and evade sanctions (U.S. DOJ).

The bank-robbing subgroup, BeagleBoyz, got its own joint CISA/Treasury/FBI/U.S. Cyber Command advisory in August 2020 (CISA AA20-239A). Its signature method was FASTCash: malware injected into bank switch-application servers that intercepted transaction messages and authorized fraudulent ATM cash-outs, in one incident affecting upwards of 30 countries (CISA AA20-239A). The advisory put attempted thefts at nearly $2 billion since at least 2015, and singled out the 2016 theft of $81 million from the Bank of Bangladesh — part of an attempted $1 billion theft the Federal Reserve Bank of New York halted after spotting anomalies (CISA AA20-239A).

Cryptocurrency theft became the operation’s most notorious phase. In April 2022, the FBI confirmed that Lazarus Group and APT38 were responsible for the March 23 hack of Axie Infinity’s Ronin bridge — 173,600 ETH and 25.5 million USDC, about $625 million, drained using hacked private keys; OFAC sanctioned a Lazarus-linked Ethereum wallet the same day (CoinDesk; SC Media). Four months later, OFAC sanctioned the virtual-currency mixer Tornado Cash, stating it had laundered more than $455 million stolen by the Lazarus Group (U.S. Treasury). The largest single theft attributed to North Korea came in February 2025: the FBI held North Korea responsible for the theft of approximately $1.5 billion in virtual assets from the Bybit exchange on or about February 21, tracked under the name “TraderTraitor” (FBI). A money-laundering arm of the conspiracy also reached into North America: Ghaleb Alaumary of Mississauga, Ontario, pleaded guilty to laundering funds from North Korean ATM cash-outs and cyber bank heists (U.S. DOJ).

Name	Who coined it	What it denotes
Lazarus Group	Novetta’s Operation Blockbuster consortium (2016)	Industry umbrella term for the cluster (iTnews)
HIDDEN COBRA	U.S. government	U.S. government’s collective name for DPRK cyber activity (CISA AA20-239A)
APT38 / BlueNorOff	FireEye / Kaspersky	Industry names for the financially motivated subgroup (CISA AA20-239A)
BeagleBoyz	U.S. government	Bank-robbing team, a Hidden Cobra subset overlapping Lazarus/APT38 (CISA AA20-239A)
TraderTraitor	FBI	Name for the crypto-theft campaign behind the Bybit hack (FBI)
Stardust Chollima	CrowdStrike	Vendor name for part of the same cluster (CISA AA20-239A)

When a “Lazarus” label got it wrong

In September 2025, the watchdog Accountable.US published its “American Sell-Out” report claiming that World Liberty Financial had sold governance tokens to a wallet it linked to the Lazarus Group (CoinTelegraph). Two U.S. senators cited the report in November 2025 when urging federal regulators to investigate the firm (CoinTelegraph). But blockchain researcher Nick Bax reviewed the transactions and concluded the “Lazarus-linked” transfers were false positives: a joke memecoin contract called Dream Cash automatically routes tokens from an address merely labeled “Lazarus” to anyone who claims them, and an independent user had claimed the tokens as a joke (CoinTelegraph). MetaMask security lead Taylor Monahan likewise disputed the finding, and the flagged user reportedly had roughly $95,000 in WLFI tokens frozen as a result (CoinTelegraph). World Liberty Financial denied the allegations, citing AML/KYC checks on presale buyers (CoinTelegraph). A wallet-database label is an assertion, not evidence.

FAQ

Is Lazarus Group officially part of the North Korean government? “Lazarus Group” itself is an industry tracking name, not a registered organization — but the U.S. government attributes the underlying activity to North Korea, specifically to units of the Reconnaissance General Bureau, per the 2021 DOJ indictment (U.S. DOJ). The indictment alleged the actors furthered the interests of the DPRK government and Kim Jong Un.

How much money has Lazarus Group stolen? Figures vary by source. The 2021 DOJ indictment alleged a conspiracy to steal or extort more than $1.3 billion; CISA’s 2020 advisory put bank-theft attempts at nearly $2 billion; OFAC said Tornado Cash laundered over $455 million stolen by the group; and the FBI attributed the $1.5 billion Bybit theft to North Korea (U.S. DOJ; CISA; U.S. Treasury; FBI).

What is the difference between Lazarus Group, APT38, and TraderTraitor? They are different names for the same attributed operation or its parts, coined by different analysts. Lazarus Group is the industry umbrella term; APT38 (and BlueNorOff) name the financially motivated subgroup; TraderTraitor is the FBI’s name for the crypto-theft campaign behind the Bybit hack; and HIDDEN COBRA is the U.S. government’s collective designation (CISA; FBI).

Was World Liberty Financial really funded by Lazarus Group? No — that allegation came from Accountable.US’s 2025 “American Sell-Out” report and was disputed, not confirmed. Blockchain researcher Nick Bax traced the flagged transfers to the Dream Cash joke memecoin, whose contract auto-routes tokens from an address merely labeled “Lazarus”; MetaMask’s Taylor Monahan agreed; and World Liberty Financial denied the claims, citing its AML/KYC screening (CoinTelegraph).

Has anyone been prosecuted for the Lazarus operations? The U.S. charged three alleged North Korean programmers in a 2021 federal indictment, but they are believed to be in North Korea and are presumed innocent (U.S. DOJ). Convictions so far involved facilitators: money launderer Ghaleb Alaumary pleaded guilty to laundering proceeds of North Korean ATM cash-outs and cyber bank heists (U.S. DOJ).

What this profile does not claim

This profile presents every operation as an attribution by the named source — U.S. indictments and advisories, industry consortium reports, or the U.N. Panel of Experts — not as established fact about a confirmed entity called “Lazarus Group.” North Korea has not acknowledged the attribution, and the 2021 DOJ defendants are presumed innocent. It does not claim to know the group’s internal structure, size, or headquarters, and it flags that different sources use different subgroup labels (APT38, TraderTraitor, BeagleBoyz) for overlapping activity, so figures from different sources cannot be cleanly added together. The 2025 World Liberty Financial wallet dispute is presented as a contested allegation and a disputed false positive, not as evidence that Lazarus transacted with the company.