On-chain monitoring account Lookonchain indicates that on August 28th, wallets associated with the North Korean hacking group Lazarus experienced another large transfer, with 244.148 bitcoins being sent out. Calculated at the then Bitcoin price of approximately $79,500 per coin, this amount of funds is worth about $19.42 million.
At present, it is still unclear to the outside world where this funds have gone. Lookonchain has not disclosed the recipient's address, nor has they explained whether the funds have flowed into exchanges, coin mixing tools, or simply been transferred to other wallets controlled by that organization. Therefore, based solely on this transfer, it is currently impossible to determine whether Lazarus has already sold the relevant bitcoins.
A large transfer has occurred for the second time in August.
This is not the first time this month that there has been activity at the Lazarus related address. On August 12th, Lookonchain reported that another wallet associated with this organization had transferred out 262.2 bitcoins, which were worth approximately 16.64 million US dollars at that time. The recipient was a newly created address.
If estimated based on the market value at the time of the two transfers, the total amount of Bitcoin transferred within August that has been tracked exceeds $36 million. However, there is currently no public information confirming that these two amounts of funds came from the same account, nor can it be determined whether their purposes were the same.
Bybit The stolen assets are still being tracked.
The reason why such address activities have drawn attention is related to the ongoing investigation into the Bybit theft case. On August 7th, Bybit filed a lawsuit against North Korea and Lazarus Group in the United States District Court for the District of Columbia, seeking to recover assets associated with this $1.5 billion theft case.
A federal judge in the United States subsequently issued a preliminary injunction to restrict the unidentified defendant from transferring, selling, or disposing of some of the assets involved in the case. Public records indicate that this civil lawsuit is proceeding separately from the criminal investigation currently underway in the United States. The purpose of the preliminary injunction is to temporarily preserve the relevant property and does not equate to a final ruling on the case.
The Federal Bureau of Investigation (FBI) previously attributed the attack on Bybit in February 2025 to TraderTraitor with North Korean connections. FBI stated that after the attack was successful, the attackers converted some of the stolen assets into Bitcoin and other cryptocurrencies, then dispersed them across thousands of addresses on multiple blockchains to make tracking more difficult.
Distributed funds increase the difficulty of tracking.
Bybit The CEO, Ben Zhou, previously stated that by April 2025, approximately 27.6% of the stolen funds could no longer be traced. Relevant reports indicate that after the assets were split across numerous Bitcoin wallets, the difficulty of on-chain analysis significantly increased.
Chainalysis It is estimated that North Korean hackers stole at least $2.02 billion in cryptocurrency in 2025, an increase of 51% from the previous year. The organization also stated that North Korean-related activities accounted for 76% of the total losses from cryptocurrency service attacks that year.
Apart from historical cases, attacks related to Lazarus did not cease in 2026 either. In April, the cross-chain bridge based on LayerZero of KelpDAO was attacked, resulting in a loss of approximately 116,500 rsETH, which was worth about 292 million US dollars at that time. Subsequent tracking revealed that some of the unfrozen assets were further transferred through tools such as THORChain, Wasabi, Tornado Cash, and Umbra.
U.S. sanctions are still in effect.
As early as 2019, the Office of Foreign Assets Control (OFAC) of the U.S. Treasury Department included Lazarus Group on the sanctions list and identified Lazarus, Bluenoroff, and Andariel as being associated with North Korea's General Bureau of Reconnaissance. According to current U.S. regulations, U.S. individuals and institutions are generally not allowed to conduct transactions with sanctioned entities, and any related assets that enter the United States or come under the control of Americans must also be frozen and reported.
This means that if relevant Bitcoin flows into platforms or service providers regulated by the United States, compliant institutions theoretically need to take restrictive measures. It is for this reason that every large-scale transfer on the blockchain attracts market attention to the subsequent flow and cash-out pathways.
