Lazarus Group’s $19.42M Bitcoin Transfer: What the On-Chain Evidence Shows

A wallet labeled by Arkham Intelligence as linked to North Korea’s Lazarus Group moved 244.148 BTC, worth approximately $19.42 million, on August 28. Lookonchain and other reports flagged the transaction, but the receiving address has not been publicly identified. Roughly 267.5 BTC reportedly remained in the originating wallet afterward. 810

The most defensible reading is that this was a significant on-chain movement—not confirmed proof of a cash-out, a new hack, or a laundering operation. The blockchain records where coins moved, but not necessarily who controls the destination or why the transfer occurred.

What happened on August 28?

The transfer came from an address Arkham labels “Lazarus Group: Hacker.” Reports valued the 244.148 BTC at about $19.42 million at the time of the movement. The destination wallet was not publicly identified in the available reporting. 810

That distinction matters. A transfer between wallets can represent consolidation, segmentation of funds, preparation for a later transaction, or movement toward an exchange or other service. Without a known recipient, an identified service deposit, or additional forensic evidence, none of those explanations can be treated as established fact.

The reported remaining balance—about 267.526 BTC—also indicates that the originating wallet still held a substantial Bitcoin position after the transfer. 8

A broader pattern of large transfers

The August 28 transaction followed two other reported movements from Lazarus-linked wallets:

• July 30: 121.5 BTC, valued at approximately $7.74 million, moved to two unidentified wallets. 24
• Mid-August: 262.2 BTC, valued at approximately $16.64 million, moved to a new address, according to Lookonchain. 7
• August 28: 244.148 BTC, valued at approximately $19.42 million, moved from the Arkham-labeled wallet. 810

Taken together, those reported transfers equal 627.848 BTC and approximately $43.8 million based on the valuations reported for each transaction. The pattern is large enough to justify continued monitoring, but the aggregate does not reveal the funds’ ultimate purpose.

On-chain analysts may describe such movements as consistent with consolidation, fund segmentation, or possible laundering preparation. Those are investigative interpretations, not conclusions proven by the transfers alone. The key unknowns remain the same: who controls each receiving wallet, whether the addresses belong to one cluster, and whether any recipient is connected to an exchange, broker, mixer, bridge, or other identifiable service.

Is the Bitcoin connected to the Bybit hack?

The timing has attracted attention because Bybit announced a U.S. lawsuit on August 7 against North Korea, its Reconnaissance General Bureau, and Lazarus Group over the approximately $1.5 billion February 2025 theft. The FBI attributed the attack to North Korean actors tracked as TraderTraitor. 2127

Bybit’s legal action includes efforts to trace and preserve assets. Reporting on the case describes a preliminary injunction covering certain identified assets held by unidentified defendants, as well as court-backed discovery intended to help identify relevant intermediaries and transaction histories. 2124

But the available evidence does not establish a transaction-level link between the August 28 Bitcoin transfer and the Bybit proceeds. The Bybit theft was reported primarily as an Ethereum theft, while the August movement involved BTC. Asset conversions and cross-chain tracing can create connections, but those connections must be demonstrated through address-level forensic analysis. Until investigators identify such a link, describing the 244.148 BTC as Bybit funds would overstate the evidence.

Why the movement matters anyway

The transfer is significant because it shows continued activity in wallets attributed to a group associated with repeated cryptocurrency theft and complex fund movements. Chainalysis estimated that North Korea-linked hackers stole at least $2.02 billion in cryptocurrency during 2025, bringing its cumulative estimate of DPRK-linked theft to at least $6.75 billion. The February 2025 Bybit compromise was a major contributor to the 2025 total. 45

That broader context explains why a large movement from a Lazarus-labeled address triggers immediate scrutiny. Exchanges, custodians, bridges, and blockchain investigators watch for the next steps: deposits into identifiable services, rapid splitting across new wallets, cross-chain swaps, or other activity that could reveal control of the funds.

Still, wallet labels are attribution tools, not courtroom findings. An address label can be highly useful for tracking clusters, but it does not automatically prove that every recipient is controlled by Lazarus Group or that every asset in the cluster came from the same theft.

What is known—and what is not

Known from the available reports:

• A wallet labeled by Arkham as Lazarus-related moved 244.148 BTC on August 28. 810
• The reported value was approximately $19.42 million. 810
• About 267.5 BTC reportedly remained in the originating wallet. 8
• The public destination was not identified in the available reporting. 8
• Similar large transfers were reported on July 30 and in mid-August. 27

Not established by those reports:

• That the transfer was a sale or cash-out.
• That it was a new theft.
• That it was part of a confirmed laundering route.
• That the funds came from the Bybit hack.
• That the unidentified recipient is controlled by Lazarus Group.

The clearest conclusion is therefore limited but important: Lazarus-linked wallet activity has intensified or remained active across several large Bitcoin movements, while the ownership and purpose of the receiving addresses remain unresolved. The next identifiable service interaction or forensic attribution will be more informative than the transfer alone.