Lazarus Group Moves $19.4 Million in Bitcoin as Destination Remains Unknown

On Aug. 28, 2026, wallets attributed to North Korea-linked Lazarus Group transferred 244.148 BTC, valued at approximately $19.42 million at the time of reporting. Lookonchain flagged the movement, while contemporaneous coverage cited Arkham Intelligence’s labeling of the wallets. The receiving address was not publicly identified. 2411

The key conclusion is narrower than some headlines suggest: the transaction shows movement between Bitcoin addresses, not a confirmed sale, cash-out, laundering path, or ultimate beneficiary. 910

What happened in the Aug. 28 transfer?

Lookonchain reported that Lazarus-linked wallets had become active again and moved 244.148 BTC, or about $19.42 million. Arkham Intelligence was cited in related reporting for its attribution of the wallets to Lazarus Group. 2411

Public reporting did not establish whether the destination was:

• a centralized cryptocurrency exchange;
• a mixer or other obfuscation service; or
• another wallet controlled by Lazarus Group or a North Korean-linked entity.

That uncertainty matters. A blockchain transfer records where coins moved, but attribution of the destination and the purpose of the transaction generally requires additional address clustering, exchange records, or investigative evidence.

How the three transfers add up

The Aug. 28 movement followed two other notable transfers attributed to Lazarus-linked wallets:

Date	Bitcoin moved	Reported value	Destination reported publicly
July 30, 2026	121.5 BTC	About $7.74 million	Two unidentified addresses 37
Aug. 12, 2026	262.2 BTC	About $16.64 million	A newly created address 814
Aug. 28, 2026	244.148 BTC	About $19.42 million	Not publicly identified 910

Using the contemporaneous valuations reported for each transaction, the three transfers represent roughly $43.8 million in Bitcoin moved over about a month. The dollar totals are historical estimates and can change with Bitcoin’s price; they should not be treated as the current value of the coins.

On Aug. 12, reporting placed monitored Lazarus-linked on-chain assets above $73.06 million, primarily in BTC, USDT and ETH. 8 That figure covered a broader group of monitored wallets, not necessarily the specific source wallet used for the Aug. 28 transfer.

What was left in the source wallet?

The precise post-transfer balance of the specific Aug. 28 source wallet is not consistently established by the public reports provided. One report described a consolidated portfolio of roughly $40 million and listed 267.526 BTC valued at about $20.97 million at the cited Bitcoin price. 11

Those figures should be read cautiously: wallet-level balances, consolidated clusters and broader Lazarus-linked holdings are different measurements. The available reporting does support the broader conclusion that Lazarus-attributed wallets retained substantial assets after the recent transfers, but it does not provide a single independently verified post-transfer balance for the source wallet.

Is the Bitcoin connected to the Bybit hack?

The Aug. 28 transfer has not been publicly proven to represent proceeds from one particular hack. Its significance comes partly from its timing: investigators, exchanges and blockchain analysts have been tracing cryptocurrency associated with the Feb. 21, 2025 Bybit theft, in which approximately $1.5 billion in virtual assets was stolen. 25

The FBI attributed that theft to North Korea and referred to the operation as “TraderTraitor.” The agency said the stolen assets were converted into Bitcoin and other cryptocurrencies and dispersed across thousands of wallets on multiple blockchains. 2526

Bybit later filed a U.S. civil lawsuit against North Korea, its Reconnaissance General Bureau and Lazarus Group over the theft, while seeking to freeze identified stolen assets. 17

That context explains why fresh activity in Lazarus-labeled wallets attracts scrutiny. It does not establish that the 244.148 BTC transferred on Aug. 28 came from Bybit, nor that the coins were being liquidated.

The broader scale of North Korean crypto theft

The Aug. 28 transfer is small compared with the Bybit theft but significant as part of a wider pattern of cryptocurrency theft attributed to North Korea-linked actors. One industry estimate put North Korean-linked crypto theft at $2.02 billion in 2025 and estimated that those actors represented 76% of crypto-hack value through April 2026. These are private-sector estimates, not a definitive government accounting. 32

The figures also describe estimated theft activity across a broader North Korea-linked ecosystem; they should not be treated as the value of the Lazarus wallets involved in the Aug. 28 transaction.

U.S. sanctions are another part of the background. The provided reporting identifies Lazarus Group as a sanctioned, DPRK-linked hacking operation and notes that OFAC placed the group on its Specially Designated Nationals list in 2022. 32 The supplied sources do not independently document the user-requested 2019 sanctions date, so that date is not stated here as established fact.

What remains unknown

Several important questions remain unanswered:

1. Who controlled the receiving address? Public reports had not identified it as an exchange, mixer or known Lazarus-controlled wallet. 910
2. Was the transfer a cash-out attempt? No. A wallet-to-wallet movement alone does not demonstrate a sale or conversion to fiat currency. 9
3. Was it linked to Bybit? No public source provided a confirmed transaction-level link between the Aug. 28 transfer and the Bybit theft.
4. How much does Lazarus still control? Reports offer different scopes—specific wallets, consolidated portfolios and monitored clusters—so their figures cannot be combined into one definitive balance. 811

For now, the defensible reading is that Lazarus-attributed Bitcoin wallets moved another large amount of BTC after a series of substantial transfers in July and August. The movement is a useful signal for investigators and compliance teams, but the on-chain transaction alone does not reveal the funds’ final destination or purpose.