North Korea's state-sponsored hackers have quietly become the world's most lucrative financial heist operation, funding missiles with stolen crypto. Operating under the Reconnaissance General Bureau across three specialised units — Lazarus, Bluenoroff and Andariel — the group has drained over US$6 billion in digital assets since 2017. Unlike typical cybercrime, it is a revenue arm of a nation state, making every breach a geopolitical event rather than an IT problem.
Anatomy of a state crew
Active since 2009, with an estimated 6,000+ Bureau 121 personnel, the group recruits young operators from elite universities, sends them to China to learn the open web, then returns them to Pyongyang or embeds them inside foreign shell companies posing as freelance developers. Its track record reads like a résumé: US$35M from Sony Pictures (2014), US$81M from Bangladesh Bank via SWIFT (2016), the WannaCry ransomware paralysing the UK's NHS (2017), US$625M from the Ronin Network bridge (2022), US$540M across WazirX and DMM Bitcoin (2024), and a record US$1.5B from Bybit (Feb 2025) via a Safe Wallet UI exploit. Most recently, LayerZero attributed a US$292M KelpDAO breach to Lazarus, with a single-verifier setup as the weak link. Sources cited include the FBI, US Treasury, Elliptic, LayerZero and Mandiant.
Key findings
- Lazarus has drained over US$6 billion in digital assets since 2017, routed back to Pyongyang's weapons programs through mixers and OTC desks.
- The February 2025 Bybit breach of US$1.5B is the largest crypto heist ever, exploiting the Safe Wallet UI during a routine cold-to-warm transfer.
- Active since 2009 with an estimated 6,000+ Bureau 121 personnel, Lazarus runs three units: Lazarus (espionage), Bluenoroff (banks and crypto) and Andariel (critical infrastructure).