North Korea's Lazarus crypto theft tops $2bn as Treasury hits IT-worker launderers
Pyongyang's hackers drove 76% of 2026 crypto-hack value while OFAC and DOJ pursued the fake-employee revenue machine
Summary
North Korea's Lazarus cluster, under the Reconnaissance General Bureau, stole an estimated $2.02bn in crypto in 2025, a 51% rise, and accounted for ~76% of all crypto-hack value through April 2026, including a $292m Kelp DAO exploit. The FBI attributes the record $1.5bn Bybit theft to the TraderTraitor subunit. In March 2026 OFAC sanctioned six people and two entities that laundered ~$800m, and DOJ filed a $7.74m forfeiture, targeting the DPRK IT-worker scheme, operatives using stolen identities to win remote tech jobs and funnel pay to Pyongyang. Laundering adapted after the Tornado Cash takedown rather than slowing.
By the numbers
- $2.02bn, DPRK crypto theft in 2025 (+51% YoY); ~$6.75bn cumulative.
- 76%, share of crypto-hack value DPRK actors drove through April 2026.
- $1.5bn, the Bybit heist, the largest single crypto theft on record.
- ~$800m, laundered by the network OFAC sanctioned in March 2026.
- $7.74m, DOJ civil-forfeiture complaint over laundered DPRK funds.
Why it matters
Crypto theft and IT-worker fraud are now Pyongyang's most scalable hard-currency source, underwriting its missile program outside the banking system. Each designation forces a laundering pivot, mixers, OTC desks, stablecoins, keeping enforcement a step behind.
What to watch
- Whether US firms tighten remote-hire vetting against fake DPRK identities.
- The next laundering venue after Tornado Cash and sanctioned exchanges.
- Coordinated action by the MSMT states.