In March 2024, an employee working at the Japanese wallet software company Ginco encountered a "recruiter" on LinkedIn. The person sent him an onboarding test that required processing a piece of Python code.
Recruitment websites, code-hosting platforms and technical tests are all familiar things to programmers looking for work. But according to investigations later published by the U.S. Federal Bureau of Investigation and the Japanese National Police Agency, this contact allowed attackers to compromise the employee's device. Two months later, the other party used the stolen login session to impersonate this employee, entered the company's communications system, and very likely used it to tamper with a legitimate transaction request from the client DMM Bitcoin.
What was ultimately lost was 4,502.9 bitcoins, worth approximately US$308 million at the price at the time of the incident. The person who obtained this money did not appear in the guise of a masked robber. He first walked into your daily life in the identity of someone who might help you change jobs.
This also explains why, when discussing North Korean hackers today, merely saying that "their technology is very strong" is no longer enough.
On October 31, 2026, the FBI again attributed the theft of more than US$6 billion in virtual assets from Binance to North Korea, still using the operational label TraderTraitor. Binance's previously published preliminary investigation mentioned that the computer of a DevOps engineer may have been compromised, after which the attackers obtained access to service containers and submitted unauthorized withdrawal transactions; the platform stated at the time that no evidence of wallet private key leakage had yet been found.
The investigation is still ongoing.
From a recruitment test to an exchange's wallets, employee devices and vendor systems, North Korea-related cyber operations have continuously entered the workflows of the crypto industry. The name most familiar to the outside world is Lazarus, the Lazarus Group. But behind this name, what kind of people are they, and how do they turn assets on a screen into money they can actually control in the real world?
Behind Lazarus, how much of North Korea's intelligence system can be clearly seen
Lazarus easily brings to mind an independent secret squad: with a fixed leader, clearly defined members, and an unknown operations room. But most of the materials we can read come from sanctions documents, judicial investigations, victim reviews and tracking by security companies. This name is mainly a label used externally to identify cyber activity, and may not really be the formal name of a department inside North Korea.
In 2019, the U.S. Department of the Treasury sanctioned three organizations, Lazarus, Bluenoroff and Andariel, determining that they were controlled by North Korea's Reconnaissance General Bureau. The Reconnaissance General Bureau is an important North Korean intelligence agency, abbreviated in English as RGB. That announcement also linked Lazarus to the 110 Research Center under the Third Bureau of the Reconnaissance General Bureau. Another sanctions announcement in 2023 further disclosed the relationship among the Technical Reconnaissance Bureau, the 110 Research Center and Pyongyang University of Automation: some institutions are responsible for cyber operations and tool development, while dedicated schools train technical personnel who later enter the relevant units.
Putting these materials together, one can see a personnel supply chain with training and organizational support. As for the common online claims that "a certain bureau has how many people" or that "all hackers are uniformly commanded by a certain department," the public evidence is far from that complete.
Rather than drawing a seemingly precise organizational chart of a secret organization, it is better to first look downward along the people who have already surfaced.
Park Jin-hyuk is one of them. In 2018, the U.S. Department of Justice announced criminal charges against him, alleging that he had worked for Chosun Expo Joint Venture. That company, which presented itself externally as a technology enterprise, was identified by the U.S. side as a front entity for the North Korean government, involved in supporting malicious cyber operations. An indictment announced in 2021 added two North Korean programmers, identifying the three as members of units affiliated with the Reconnaissance General Bureau.
These are prosecutorial allegations, but they offer clues more specific than the "genius hacker" image: a person may have a corporate identity, a work email address and an outward-facing technology business, while at the same time being alleged to have participated in state-sponsored cyber operations.
What a client encounters may be nothing more than a programmer who can take on projects and write code. According to the prosecution materials, Park Jin-hyuk and his associates did in fact perform programming work for overseas paying clients; these outward-facing business activities coexisted with the cyberattacks they are alleged to have participated in.
In the Park Jin-hyuk case, the U.S. side used "Lazarus" to refer to the team he belonged to; by the time of the DMM and Bybit cases, the FBI was using the name TraderTraitor. Add to that the Bluenoroff and Andariel names commonly seen in reporting, as well as APT38 (APT is the English abbreviation for "advanced persistent threat"), and readers can easily assume that behind each name there is a corresponding department and a fixed group of members that can be identified.
These names overlap, yet there is no internal roster that outsiders can verify one by one. Seeing that two cases are both attributed to "Lazarus" does not establish that the same group of people carried out each one. Returning attention to the specific case—who obtained access, who took over the money—brings us closer to the division of labor that we can actually ascertain.
The tasks of this cyber force have never been limited to stealing coins. The destructive attack on Sony Pictures in 2014, the theft from the central bank of Bangladesh in 2016, and the spread of WannaCry ransomware in 2017 all later appeared in U.S. allegations and attribution materials concerning North Korea-related individuals. Political retaliation, destruction, intelligence gathering and fundraising appear interwoven across different cases. The crypto industry later became an important target, precisely taking on one of the needs most easily converted into sustained revenue: getting the money.
From bank transfers to massive assets in cross-chain bridges
The Bangladesh central bank case already demonstrated the financial objectives of such operations. According to allegations disclosed by the U.S. Department of Justice, the attackers breached the bank's network and sent fraudulent interbank payment instructions, ultimately causing approximately USD 81 million to be stolen. After the money entered the traditional banking system, it still had to pass through accounts, receiving institutions and subsequent transfers before there was any chance of actually taking it away.
Crypto assets offered another set of conditions. If attackers gain control of the authority to issue valid transactions, they may be able to transfer assets to addresses they control within a very short time. Receiving an on-chain transfer also does not require first persuading a bank to open an account for them. Of course, converting the coins into fiat currency or purchasing goods still brings them up against real-world counterparties.
The step of "first moving the assets away" can be accomplished entirely without relying on traditional financial institutions, and this is the freedom most championed by the crypto world represented by Bitcoin.
North Korea-related attackers entering this market used an early approach that required considerable patience: building crypto trading software that looked normal and waiting for industry practitioners to install it themselves.
In 2021, the U.S. Cybersecurity and Infrastructure Security Agency, the FBI and the Department of the Treasury jointly disclosed the AppleJeus malware campaign. AppleJeus is the name the security agencies gave to this type of software. The attackers approached targets through seemingly legitimate corporate websites and trading applications, causing users searching for trading tools to bring malicious programs onto their computers along with them. For people who need to manage trading accounts, wallets or company technical systems, a single software installation may bring risks on a personal device right next to the company's assets.
By 2022, a larger pool of funds had emerged among attack targets: cross-chain bridges.
Cross-chain bridges help users transfer assets between different blockchains. Some bridges first lock assets on one side and then issue corresponding vouchers or assets on the other side. Users are thus able to use their funds across chains, and the bridges themselves accumulate large amounts of assets used to back those vouchers. For attackers, finding permissions sufficient to approve disbursements creates an opportunity to reach the funds on which many users collectively rely.
In March 2022, the Ronin network serving the blockchain game Axie Infinity was hacked, with losses including 173,600 ether and 25.5 million USDC.
The most memorable aspect of this breach is that the attackers obtained the signing authority of five of nine validators. The system originally required approval by a certain number of validators before withdrawals could be executed; once the attackers held enough valid signatures, a forged withdrawal request crossed that threshold. The FBI subsequently attributed the case to Lazarus and APT38-related actors.
When people discuss blockchain security, they often look first at algorithms and contract code. The Ronin case reminds us to also examine who holds the signing keys, where authority is actually concentrated, and whether there are independent lines of defense between the several approval steps. A protocol can enforce its rules strictly, yet the authority behind those rules may be taken from it first.
In the same year, approximately USD 100 million in assets was stolen from Harmony's Horizon cross-chain bridge. In January 2023, the FBI publicly attributed that case to the North Korea-related Lazarus Group. Later, wallets and payment businesses such as Atomic Wallet, Alphapo and CoinsPaid also appeared in FBI attribution announcements.
The shift in targets is telling. Attackers are no longer pursuing only a particular exchange, but every entry point through which crypto assets pass: where they are stored, who approves their transfer, which software presents transactions, and which service provider has access to critical operations. Whoever occupies those positions in the course of their work may be selected.
DMM and Bybit: Approaching Those with Authority First
Returning to the Ginco employee mentioned at the beginning of this article: he was not a DMM Bitcoin employee, yet he stood on the service chain on which DMM's fund management depended. The attackers approached him under the pretext of recruitment and obtained not merely an ordinary social media account, but an opportunity to push further into the wallet service provider's internal systems.
According to the account disclosed in the joint Japan-U.S. announcement, after the contact in March 2024, the attackers used session information from mid-May onward to impersonate the employee and enter Ginco's communications systems. By late May, they very likely used this entry point to manipulate DMM employees' legitimate transaction requests. Several months were spent connecting what appeared to be an insignificant recruitment contact to the actual business actions capable of transferring assets.
This is far more complex than an employee clicking a phishing link. The recruiters needed to make the test appear credible, and after compromising the device they also had to understand the work systems, find the links related to client transactions, and then get the erroneous request approved. An engineer's technical ability cannot automatically substitute for independent verification of recruiter identity, device isolation and transaction requests.
On February 21, 2025, approximately USD 1.5 billion in virtual assets was stolen from Bybit, bringing this problem to the doorstep of cold wallets. A cold wallet generally refers to an arrangement that isolates critical signing material from the everyday networked environment, and many people therefore believe that as long as coins are kept in a cold wallet, attackers will find it difficult to get close.
But the funds in a cold wallet must eventually be transferred out. At that point, the signer needs to see the transaction, assess the transaction, and then execute the signature. In the Bybit incident, what the attackers targeted was precisely this segment: the handover process between people and systems.
According to the investigation progress published by Bybit and Sygnia's technical review, the attack involved the compromise of infrastructure related to the Safe wallet, with malicious code entering the web interface used by signers. The signers believed they were approving normal operations, but the transactions they actually signed caused the wallet's control logic to be altered, and the assets were subsequently transferred. On the 26th of that month, the FBI attributed the theft to North Korea, describing the related activity as TraderTraitor.
There is a distinction here that is easily overlooked: the signatures were genuine, but the signers' understanding of what they were signing was misled. Proper safekeeping of private keys does not guarantee that every transaction they sign is one the custodian genuinely intends to carry out. If several people all rely on the same tampered display interface, multi-party approval may simply repeat the same error.
As for the Binance case at the end of October 2026, for now we can only continue to observe along the clues that have been disclosed. Binance's preliminary announcement pointed to a possible entry point in a DevOps engineer's computer and stated that no evidence of wallet private key leakage had yet been found. The FBI's announcement made a North Korea attribution but did not disclose the complete intrusion path.
However, viewing DMM, Bybit and this latest clue together already reveals a common predicament worth guarding against: a company may devote enormous effort to its wallets and contracts, yet attackers enter from alongside the employees, software pages and operational permissions on which it relies. Where the funds ultimately are does not necessarily determine where the intrusion first occurred.
Others appear in the guise of remote colleagues
Fake recruitment is about getting target employees to open something the attackers deliver. Another route, disclosed repeatedly, is for attackers themselves to enter the recruitment process and seek to be hired by the company.
In June 2025, the U.S. Department of Justice announced a joint operation targeting a revenue network of North Korean remote technical personnel. The relevant cases disclosed that some individuals used stolen or fictitious identities to apply for jobs, with facilitators inside the United States receiving computers sent by employers and then having overseas personnel connect remotely. The locations where these computers were centrally stored and kept running are known as "laptop farms."
From the employer's perspective, the computer was delivered to a local address, the connection went through local equipment, and a remote colleague appeared to be working normally. What sustained this appearance, however, may have been collaboration among overseas technical personnel, identity providers, payment arrangements and device hosts. Impersonating technical personnel could deliver work, collect pay and generate revenue for North Korea-related networks.
In a case disclosed in the same round of law enforcement announcements in June 2025, prosecutors alleged that the individuals concerned, after obtaining remote work at two crypto companies, used their work-related access to assets to commit theft; one of the incidents involved modifying the employer's smart contract source code, and the two companies suffered combined losses of more than USD 900,000. U.S. law enforcement agencies also warned that some impersonating remote personnel steal corporate data and carry out extortion.
The hardest part here is that companies genuinely need technical talent. Remote collaboration lowers geographic limits on hiring, but it also makes identity, location and the actual operator harder to verify through a single online interview. As long as an engineer delivers on time, the business team may gradually grant him more permissions. By the time those permissions cover code releases, production systems or wallet operations, the gap left by that initial identity verification will have grown along with the job.
Only after the coins are stolen do certain other people make their entrance
Stealing USD 1.5 billion in assets and obtaining USD 1.5 billion in freely usable cash are two different things. Addresses may be flagged, centralized platforms may block deposits, and some stablecoin issuers may also freeze the relevant tokens pursuant to their authority and rules.
Therefore, handling the funds after the theft is not incidental work; it is the key to whether the entire operation can yield actual returns.
In its announcement on the Bybit case, the FBI stated that the attackers quickly converted some of the assets into virtual assets such as Bitcoin and dispersed them across a large number of addresses on multiple chains.
These actions increase the difficulty of tracing and interdiction, but they cannot make historical transactions automatically disappear. For the attackers, after the on-chain transfers there is another question: who is willing to take on these assets, give them fiat currency, or complete real-world payments on their behalf? At this point, those who control exchange channels, accounts and business connections begin to matter.
In 2020, the U.S. Department of Justice indicted two Chinese nationals, Tian Yinyin and Li Jiadong, accusing them of laundering more than USD 100 million in crypto assets for North Korea-related attackers. Prosecutors' materials stated that the relevant funds mainly came from exchange thefts, and that the two provided paid money-transmission services through accounts and transfers. The case materials also alleged that some of the laundered funds were used to pay for infrastructure needed for subsequent attacks against the financial industry.
These are charges disclosed by prosecutors, but they push the boundary of the "hacker group" outward by one step. Those who take the assets need technical knowledge; those who take over the assets may be more familiar with opening accounts, exchanging currencies and making payments. Proceeds from one theft may also in turn pay the costs of the next round of operations. Tracing only the programmers who carried out the intrusions cannot explain why this set of operations could run repeatedly.
The Tian Yinyin and Li Jiadong case also shows us that asset recovery is not just about seeing where the coins went. After the money flows from the stolen exchange into exchange accounts, investigators must also examine who used the accounts and what connection the recipients had with the intruders, in order to link the theft and the money laundering. To further determine that the attacks came from North Korea-related organizations, clues beyond the funds must also be connected.
In the materials released in the Park Jin-hyuk case, the clues listed by the U.S. side include email addresses and aliases reused in different attacks, similar malicious code, and access records of the relevant accounts. On-chain fund records also need to be corroborated with clues about accounts, devices and real people before it is possible to gradually trace who was operating. A string of wallet addresses alone cannot reveal the operator's nationality.
These investigative materials have brought some personnel and methods of collaboration to the surface, but the complete internal roster remains unavailable. Some attribution announcements also published only conclusions and the relevant addresses, without disclosing all the investigative basis. Understanding of Lazarus has thus slowly accumulated case by case: we can see how they approach targets and how they move the money away, but we cannot yet say that the entire organization has been fully mapped.
Conclusion
The crypto industry uses an open network to enable people who have never met to trade and collaborate. North Korea-related operations remind us that this network is also open to organized attackers: they can look for entry points in the same recruitment markets and then handle their proceeds in the same financial markets. A country subject to financial sanctions may also borrow the efficiency of global markets to replenish funding for its operations.
The crypto world is open and fair, but someone always has to pay the price for this freedom.
