Lazarus Group Linked to Nearly $7.8B in Crypto Theft
The Lazarus Group, the umbrella term for North Korea-linked cyber operations, is increasingly viewed as one of crypto’s biggest security threats. Including the suspected September 2026 Bitget hack, losses linked or strongly attributed to North Korean hackers have approached $7.8 billion.
Bitget initially reported losses of about $351.6 million before revising the confirmed transferred assets to $387.5 million. TRM Labs identified overlaps between the laundering routes in the Bitget attack and earlier incidents involving Bybit and AFX Bridge. Elliptic also assessed a North Korea connection as highly likely.
The Lazarus Group label covers several activity clusters linked to North Korea’s Reconnaissance General Bureau. BlueNoroff targets banks and crypto companies through social engineering. TraderTraitor focuses on exchanges, custodians, developers and wallet infrastructure. It has been linked to the $1.5 billion Bybit theft, the DMM Bitcoin attack, and incidents involving Atomic Wallet, Alphapo and CoinsPaid. Citrine Sleet, also known as AppleJeus, uses fake wallets, trading software, browser exploits and supply-chain attacks. Famous Chollima infiltrates companies through fake remote IT workers.
Major confirmed or government-attributed incidents include the Ronin Bridge, Harmony Horizon Bridge, Upbit, Atomic Wallet and Bybit attacks. Chainalysis reported that North Korea-linked hackers stole about $2 billion in crypto during 2025 alone. For traders, the Lazarus Group threat highlights continuing exchange, custody, software supply-chain and insider-access risks. The news could increase security scrutiny, demand for self-custody and risk premiums across crypto markets.
Bearish
The direct price impact is likely bearish for affected exchanges and related crypto-market sentiment, although the report does not identify a specific token under immediate selling pressure. In the short term, traders may reduce exposure to platforms linked to the incidents, move assets to self-custody, and demand higher risk premiums. Security concerns can also increase volatility and weaken confidence in exchange and wallet infrastructure.
The impact is unlikely to be uniformly bearish across the entire market because the attacks do not represent a fundamental deterioration in blockchain networks or crypto-asset utility. However, the revised Bitget loss figure, links to previous laundering routes, and the estimate of nearly $7.8 billion in related theft reinforce the scale and persistence of the threat. Over the longer term, stronger exchange disclosures, transaction monitoring, custody controls and supply-chain security could improve market resilience. Until those measures are demonstrated, recurring Lazarus Group attacks are likely to weigh on sentiment and keep security-related risk priced into crypto markets.