{"id":48841,"date":"2026-07-30T06:51:43","date_gmt":"2026-07-30T06:51:43","guid":{"rendered":"https:\/\/cryptomag.finance\/?p=48841"},"modified":"2026-07-30T06:51:43","modified_gmt":"2026-07-30T06:51:43","slug":"lazarus-just-moved-7-7m-in-bitcoin-after-hackers-stole-577m-in-2026","status":"publish","type":"post","link":"https:\/\/cryptomag.finance\/?p=48841","title":{"rendered":"Lazarus just moved $7.7M in Bitcoin after hackers stole $577M in 2026"},"content":{"rendered":"

A wallet cluster associated with North Korea\u2019s Lazarus Group transferred 121.5 Bitcoins<\/a>, worth around $7.74 million, roughly an hour before the blockchain tracker Lookonchain identified the transaction on Thursday. The amount is significant, given that transactions from wallets tied to Lazarus Group generally do not go unnoticed.<\/strong><\/p>\n

The importance lies more in what this kind of movement could imply than its actual value. By April of 2026, North Korea-related hackers made up 76% of all hacking-related cryptocurrency thefts. Even small transactions could be evidence that stolen funds are being laundered once again.<\/p>\n

Lazarus wallets stir again<\/h3>\n

According to Lookonchain, wallets associated with the Lazarus Group moved 121.5 BTC, estimated to be about $7.74 million. However, the company did not reveal the whereabouts of the funds and did not tie it to a specific previous theft.<\/p>\n

By itself, the transaction holds little meaning in a market with daily trading volume of tens of billions of dollars. What makes it significant, however, is the wallet in question. Lazarus addresses attract significant scrutiny because each transaction has the potential to move stolen cryptocurrencies closer to conversion into usable money.<\/p>\n

\n

The Lazarus Group hackers moved 121.5 $BTC<\/a> ($7.74M) an hour ago.https:\/\/t.co\/kpMHWnl7iQ<\/a> pic.twitter.com\/5qrmlvxMGd<\/a><\/p>\n

\u2014 Lookonchain (@lookonchain) July 30, 2026<\/a><\/p><\/blockquote>\n

TRM Labs estimated that North Korean hackers stole about $577 million<\/a> in cryptocurrency through April 2026. Nearly all of it came from two attacks: a $285 million exploit of Drift Protocol on April 1 and a $292 million attack on a KelpDAO bridge on April 18. Although the incidents represented just 3% of recorded hacks, they accounted for 76% of the year\u2019s stolen value.<\/p>\n

The trend has gotten stronger over the years. The experts at TRM believe that North Korea\u2019s contribution to the global volume of cryptocurrency theft increased from below 10% in 2020 and 2021 to 22% in 2022, 37% in 2023, 39% in 2024, 64% in 2025, leading to a new record in the current year. Since 2017, North Korean hackers have stolen over $6 billion worth of digital currencies, securing the status of the biggest state-sponsored cyber threat in the world.<\/p>\n

Bitcoin, THORChain, and the flood-the-zone playbook<\/strong><\/h3>\n

The recent activities resemble the money laundering pattern reported by TRM following the Bybit hack<\/a> in February 2025, when the North Koreans stole around $1.5 billion worth of Ether, the largest theft of cryptocurrency to date. The investigation revealed that the criminals promptly sent the funds through THORChain to convert them into Bitcoin and thereafter sent a part of the stolen funds through coin mixers such as Wasabi Wallet and CryptoMixer.<\/p>\n

The attack highlighted the shortcomings of blockchain transparency. The Center for Strategic and International Studies (CSIS) noted in its study of the Bybit case that although the investigation managed to detect many of the wallets in a matter of days, the speed of transfers through decentralized exchanges, bridges, and countries allowed much of the illegally obtained cryptocurrency to continue to circulate before law enforcement took action.<\/p>\n

Investors\u2019 confidence would likely be bolstered more by establishing strong cybersecurity standards and implementing uniform regulations than by relying primarily on post-theft enforcement.<\/p>\n

TRM\u2019s Nick Carlsen, an ex-FBI analyst, refers to the Lazarus group\u2019s strategy as \u201cflood the zone,\u201d which aims to confuse investigators by triggering numerous transactions across various platforms within a brief period. Frequently, the group does not do anything with the converted Bitcoin for some time and later on moves the funds into cash-out channels.<\/p>\n

As a result, the transfer of a mere 121.5 BTC is noteworthy. Rather than attempting to liquidate stolen assets in one large transaction, North Korean criminal outfits usually prefer to move smaller amounts over time. However, if it turns out that yet another distribution cycle is at play, exchanges, OTC traders, and blockchain investigators could see more scrutiny coming their way in the upcoming months.<\/p>\n

Sanctioned wallets the whole market must screen<\/strong><\/h3>\n

The Lazarus Group is still subject to U.S. Treasury sanctions as part of the DPRK3<\/a> program by the Office of Foreign Assets Control, which involves cryptocurrency addresses connected to the organization. Managing the money of these addresses puts companies at risk of sanctions, which means that funds labeled as being from the Lazarus Group must be treated as an immediate compliance concern.<\/p>\n

The FBI has assigned the theft of cryptocurrencies to the group several times. Among the thefts it attributed to the group are the $100 million Harmony Horizon Bridge hack<\/a> of 2022 and also the Bybit hack, which was connected to North Korea with the codename \u201cTraderTraitor\u201d in February 2025.<\/p>\n

The recent transfer of 121.5 BTC is less important for its volume than for the meaning it carries. A case in point is that the hacked assets recovered by North Korean hackers may continue to reappear months or years after the theft. Even an insignificant transaction can indicate the start of a big laundering operation as long as such wallets are still operating.<\/p>\n

If you’re reading this, you\u2019re already ahead. Stay there with our newsletter<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"

A wallet cluster associated with North Korea\u2019s Lazarus Group transferred 121.5 Bitcoins, worth around $7.74 million, roughly an hour before the blockchain tracker Lookonchain identified the transaction on Thursday. The amount is significant, given that transactions from wallets tied to Lazarus Group generally do not go unnoticed. The importance lies more in what this kind […]<\/p>\n","protected":false},"author":1,"featured_media":48842,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"footnotes":""},"categories":[45],"tags":[],"class_list":["post-48841","post","type-post","status-publish","format-standard","has-post-thumbnail","category-bitcoin"],"yoast_head":"\nLazarus just moved $7.7M in Bitcoin after hackers stole $577M in 2026 - Cryptomag<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptomag.finance\/?p=48841\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Lazarus just moved $7.7M in Bitcoin after hackers stole $577M in 2026 - Cryptomag\" \/>\n<meta property=\"og:description\" content=\"A wallet cluster associated with North Korea\u2019s Lazarus Group transferred 121.5 Bitcoins, worth around $7.74 million, roughly an hour before the blockchain tracker Lookonchain identified the transaction on Thursday. The amount is significant, given that transactions from wallets tied to Lazarus Group generally do not go unnoticed. The importance lies more in what this kind […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptomag.finance\/?p=48841\" \/>\n<meta property=\"og:site_name\" content=\"Cryptomag\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-30T06:51:43+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptomag.finance\/wp-content\/uploads\/2025\/06\/generic-crypto-image.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"560\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Crypto Magazine\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@cryptomagz\" \/>\n<meta name=\"twitter:site\" content=\"@cryptomagz\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Crypto Magazine\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48841#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48841\"},\"author\":{\"name\":\"Crypto Magazine\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\"},\"headline\":\"Lazarus just moved $7.7M in Bitcoin after hackers stole $577M in 2026\",\"datePublished\":\"2026-07-30T06:51:43+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48841\"},\"wordCount\":816,\"image\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48841#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/Lazarus-Group-has-been-funding-North-Koreas-entire-nuclear-program-with-stolen-crypto-FyfjiU.webp\",\"articleSection\":[\"Bitcoin\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48841\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48841\",\"name\":\"Lazarus just moved $7.7M in Bitcoin after hackers stole $577M in 2026 - Cryptomag\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48841#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48841#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/Lazarus-Group-has-been-funding-North-Koreas-entire-nuclear-program-with-stolen-crypto-FyfjiU.webp\",\"datePublished\":\"2026-07-30T06:51:43+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48841#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/cryptomag.finance\\\/?p=48841\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48841#primaryimage\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/Lazarus-Group-has-been-funding-North-Koreas-entire-nuclear-program-with-stolen-crypto-FyfjiU.webp\",\"contentUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/Lazarus-Group-has-been-funding-North-Koreas-entire-nuclear-program-with-stolen-crypto-FyfjiU.webp\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48841#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/cryptomag.finance\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Lazarus just moved $7.7M in Bitcoin after hackers stole $577M in 2026\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#website\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/\",\"name\":\"Cryptomag\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/cryptomag.finance\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\",\"name\":\"Crypto Magazine\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"caption\":\"Crypto Magazine\"},\"sameAs\":[\"https:\\\/\\\/cryptomag.finance\",\"https:\\\/\\\/x.com\\\/cryptomagz\"],\"url\":\"https:\\\/\\\/cryptomag.finance\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Lazarus just moved $7.7M in Bitcoin after hackers stole $577M in 2026 - Cryptomag","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptomag.finance\/?p=48841","og_locale":"en_US","og_type":"article","og_title":"Lazarus just moved $7.7M in Bitcoin after hackers stole $577M in 2026 - Cryptomag","og_description":"A wallet cluster associated with North Korea\u2019s Lazarus Group transferred 121.5 Bitcoins, worth around $7.74 million, roughly an hour before the blockchain tracker Lookonchain identified the transaction on Thursday. The amount is significant, given that transactions from wallets tied to Lazarus Group generally do not go unnoticed. The importance lies more in what this kind […]","og_url":"https:\/\/cryptomag.finance\/?p=48841","og_site_name":"Cryptomag","article_published_time":"2026-07-30T06:51:43+00:00","og_image":[{"width":1000,"height":560,"url":"https:\/\/cryptomag.finance\/wp-content\/uploads\/2025\/06\/generic-crypto-image.webp","type":"image\/webp"}],"author":"Crypto Magazine","twitter_card":"summary_large_image","twitter_creator":"@cryptomagz","twitter_site":"@cryptomagz","twitter_misc":{"Written by":"Crypto Magazine","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/cryptomag.finance\/?p=48841#article","isPartOf":{"@id":"https:\/\/cryptomag.finance\/?p=48841"},"author":{"name":"Crypto Magazine","@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040"},"headline":"Lazarus just moved $7.7M in Bitcoin after hackers stole $577M in 2026","datePublished":"2026-07-30T06:51:43+00:00","mainEntityOfPage":{"@id":"https:\/\/cryptomag.finance\/?p=48841"},"wordCount":816,"image":{"@id":"https:\/\/cryptomag.finance\/?p=48841#primaryimage"},"thumbnailUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/Lazarus-Group-has-been-funding-North-Koreas-entire-nuclear-program-with-stolen-crypto-FyfjiU.webp","articleSection":["Bitcoin"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/cryptomag.finance\/?p=48841","url":"https:\/\/cryptomag.finance\/?p=48841","name":"Lazarus just moved $7.7M in Bitcoin after hackers stole $577M in 2026 - Cryptomag","isPartOf":{"@id":"https:\/\/cryptomag.finance\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptomag.finance\/?p=48841#primaryimage"},"image":{"@id":"https:\/\/cryptomag.finance\/?p=48841#primaryimage"},"thumbnailUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/Lazarus-Group-has-been-funding-North-Koreas-entire-nuclear-program-with-stolen-crypto-FyfjiU.webp","datePublished":"2026-07-30T06:51:43+00:00","author":{"@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040"},"breadcrumb":{"@id":"https:\/\/cryptomag.finance\/?p=48841#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptomag.finance\/?p=48841"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptomag.finance\/?p=48841#primaryimage","url":"https:\/\/cryptomag.finance\/wp-content\/uploads\/Lazarus-Group-has-been-funding-North-Koreas-entire-nuclear-program-with-stolen-crypto-FyfjiU.webp","contentUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/Lazarus-Group-has-been-funding-North-Koreas-entire-nuclear-program-with-stolen-crypto-FyfjiU.webp","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/cryptomag.finance\/?p=48841#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptomag.finance\/"},{"@type":"ListItem","position":2,"name":"Lazarus just moved $7.7M in Bitcoin after hackers stole $577M in 2026"}]},{"@type":"WebSite","@id":"https:\/\/cryptomag.finance\/#website","url":"https:\/\/cryptomag.finance\/","name":"Cryptomag","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptomag.finance\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040","name":"Crypto Magazine","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","caption":"Crypto Magazine"},"sameAs":["https:\/\/cryptomag.finance","https:\/\/x.com\/cryptomagz"],"url":"https:\/\/cryptomag.finance\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts\/48841","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=48841"}],"version-history":[{"count":0,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts\/48841\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/media\/48842"}],"wp:attachment":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=48841"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=48841"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=48841"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}