North Korea Just Moved Another 121 BTC: Inside the Lazarus Group's 2026 Crypto Theft Machine
North Korea's crypto operation does not take days off. On-chain trackers flagged wallets attributed to the Lazarus Group moving another 121.5 BTC, about $7.74 million, today, one more shuffle in the steady laundering of a stockpile that dwarfs anything else in this year's theft data. The single move is small by Lazarus standards. The machine behind it is not, and this is a good moment to put today's transfer in the context of a year that North Korea has dominated.
By the numbers from security firm TRM Labs, DPRK-linked groups stole about $643 million in the first half of 2026, roughly 66% of all crypto stolen worldwide. That is not a share of a niche; it is two-thirds of the entire industry's theft losses concentrated in one state actor. Today's 121.5 BTC is a drop from that reservoir working its way toward cash.
North Korea's 2026, in one chart
| North Korea and 2026 crypto theft | Figure |
|---|---|
| Moved by Lazarus today (flagged) | 121.5 BTC (~$7.74M) |
| DPRK-stolen in H1 2026 (TRM) | ~$643M |
| Share of all H1 crypto theft | ~66% |
| Two April mega-thefts (Kelp + Drift) | ~$577M |
The same playbook, over and over
What makes Lazarus distinctive is not exotic hacking; it is patience and process. The biggest 2026 thefts attributed to the group, the $292M Kelp DAO bridge compromise and the $285M Drift Protocol takeover, both in April, began not with a smart-contract exploit but with months of social engineering to compromise a key or an insider. Then comes the drain, and then the slow laundering: consolidation, mixers like Tornado Cash, cross-chain hops, and periodic conversions to Bitcoin that get parked and later moved in tranches. Today's 121.5 BTC transfer is a textbook example of that last phase, the quiet, continuous movement of already-stolen funds toward off-ramps.
Why the steady drip matters
Small transfers like this one are easy to ignore, but they are how a nine-figure haul actually becomes usable money. Each hop is a test of whether exchanges and compliance desks are watching, and the fact that funds keep moving is a measure of how hard, and how incomplete, the effort to freeze them remains. It is also why on-chain tracking matters: the theft makes headlines for a day, but the laundering is a months-long tail that only shows up if someone is following the wallets. We keep a running record of the year's major exploits, including the ones we decoded ourselves, in our 2026 crypto hack tracker.
The bottom line
121.5 BTC is a rounding error next to the roughly $643 million North Korea has taken this year, and that is exactly the point: the money moves constantly, in pieces, long after the hacks leave the news. Two-thirds of 2026's crypto theft traces back to one state actor that treats laundering as a logistics problem, not a gamble. Today's move is one more shipment down that pipeline.
Data note. The 121.5 BTC (about $7.74M) transfer attributed to the Lazarus Group was flagged by on-chain tracker Lookonchain using Arkham Intelligence's entity labels; attribution to North Korea reflects those labels and is not independently confirmed by DEXTools News. The H1 2026 figures (about $643M, 66% of theft) are from TRM Labs, and the Kelp DAO and Drift amounts from Chainalysis, Elliptic and TRM, as compiled in our 2026 hack tracker. This is information, not financial advice.
Frequently asked questions
How much crypto has North Korea stolen in 2026?
According to security firm TRM Labs, DPRK-linked groups stole about $643 million in the first half of 2026, roughly 66% of all crypto stolen worldwide. The largest thefts were the $292 million Kelp DAO bridge compromise and the $285 million Drift Protocol takeover, both in April and both North-Korea-attributed.
What did Lazarus move today?
On-chain trackers (Lookonchain, using Arkham Intelligence entity labels) flagged wallets attributed to the Lazarus Group moving about 121.5 BTC, roughly $7.74 million, today. It is a small transfer by Lazarus standards and represents the laundering phase, moving already-stolen funds toward off-ramps, rather than a new theft. The attribution reflects Arkham's labels.
How does North Korea launder stolen crypto?
The pattern is patient and repetitive: months of social engineering to compromise a key or insider, a sudden drain, then slow laundering through consolidation wallets, mixers like Tornado Cash, cross-chain hops, and periodic conversions to Bitcoin that are parked and later moved in tranches. Small, continuous transfers like today's are how a nine-figure haul becomes usable money.
Why do small Lazarus transfers matter?
Because they are how the laundering actually works. Each hop tests whether exchanges and compliance desks are watching, and the steady movement shows how incomplete efforts to freeze the funds remain. The hacks make headlines for a day, but the laundering is a months-long tail that only surfaces if someone tracks the wallets.