North Korea Lazarus Group Crypto Hacks: 2026 Timeline

By Marcus Yeo · Published 2026-09-29 · Independent review — not affiliated with any exchange

North Korea Lazarus Group crypto exchange hacks 2026 timeline refers to the chronological pattern of exchange breaches that US and international investigators have formally or informally linked to North Korean state-sponsored hacking units, chiefly the group known as Lazarus and tracked under related names like APT38 and TraderTraitor. Not every major exchange hack carries this attribution. Some of the industry’s largest losses, including Mt. Gox and Coincheck, have never been tied to North Korea by any credible investigation.

I’ve been trading perps across a couple dozen exchanges since 2019, and one pattern has become impossible to ignore: the hacks that get a formal nation-state attribution almost always target the same piece of infrastructure, the systems that authorize and move funds out of cold storage. This piece isn’t a dollar-amount ranking (we already have that at our biggest crypto exchange hacks ranking). It’s a walk through which incidents actually carry a Lazarus attribution, from whom, and how solid that attribution is.

What Is the Lazarus Group and Why Does It Target Exchanges?

Lazarus Group is the name most commonly used for a hacking apparatus that US and UN reporting has linked to North Korea’s government. The US Treasury’s Office of Foreign Assets Control has sanctioned wallet addresses tied to the group on multiple occasions, and the FBI has issued public statements naming Lazarus, or its sub-cluster TraderTraitor, in specific exchange breach investigations. The stated motive across UN Panel of Experts reporting is straightforward: stolen crypto functions as a funding stream, reportedly tied to weapons programs, that’s harder to interdict than traditional sanctions-busting trade.

Exchanges are targeted specifically, rather than random wallets, because that’s where large pooled balances and privileged withdrawal permissions concentrate in one place. A single compromised signer or a manipulated multisig approval can move far more value than phishing individual retail wallets ever could.

The Confirmed Attribution Cases: Ronin, DMM Bitcoin, and Bybit

Three incidents in this timeline carry formal, named government attribution rather than just researcher speculation.

The Ronin Network bridge hack in March 2022 (roughly $625 million, per blockchain analytics estimates cited at the time) was formally attributed to Lazarus Group by the FBI within weeks, with OFAC sanctioning the associated wallet address soon after. It remains one of the clearest, fastest official attributions on record for a crypto hack.

DMM Bitcoin’s May 2024 breach, investigated jointly by Japanese authorities and the FBI, received a similar formal attribution to North Korean actors operating under the TraderTraitor label.

Bybit’s February 2025 cold wallet breach, the largest single crypto exchange hack by dollar value to date according to the ranking linked above, was likewise attributed by the FBI to North Korean state-linked hackers. Bybit’s public response and subsequent legal action against North Korea are covered in depth elsewhere on this site; what matters for this timeline is that the FBI attribution came with the same formal weight as Ronin’s.

KuCoin 2020: Forensics-Led Attribution, Not a Government Statement

KuCoin’s September 2020 hack (around $281 million at the time, most of it later recovered or frozen through exchange coordination) sits in a slightly different category. Blockchain forensics firms, notably Chainalysis and Elliptic, traced the stolen funds through wallet clusters and mixing patterns previously associated with Lazarus-linked addresses, and that analysis has been widely cited since. It’s a strong circumstantial case built on fund-flow tracing rather than a direct government-issued statement naming North Korea, which is a meaningfully different standard of proof than the Ronin or Bybit cases. KuCoin itself has not issued a formal attribution statement of its own beyond acknowledging the researcher findings.

Bitget 2026: A Suspected Pattern Still Awaiting Formal Confirmation

Reporting on Bitget’s 2026 incident has pointed to similarities with prior Lazarus-attributed breaches, such as the routing of funds through mixing services and targeting of withdrawal authorization flows. That’s worth stating plainly as suspicion, not fact: no government agency has issued a formal attribution naming North Korea in connection with the Bitget incident as of this writing. If that changes, this timeline entry will need updating, and readers evaluating Bitget as a platform should check the exchange’s own incident disclosures directly rather than relying on pattern-matching alone.

Which Exchange Hacks Have No North Korea Attribution?

This is the part that tends to get glossed over in pattern pieces, so I’ll say it directly: several of the industry’s biggest exchange hacks have no North Korea attribution at all, confirmed or suspected.

• Mt. Gox (2014) — widely linked to insider mismanagement and early, gradual theft; no nation-state attribution from any investigation.
• Coincheck (2018) — attackers were never publicly identified as state-linked by Japanese authorities or independent researchers.
• Bitfinex (2016) — the stolen funds were eventually traced to a US-based couple later arrested and prosecuted, with no North Korea connection reported anywhere in that case.

Lumping these in with Lazarus-attributed hacks just because they’re large is sloppy, and it’s exactly the kind of pattern-matching-without-evidence that makes the genuinely confirmed cases harder to take seriously.

Attribution Status at a Glance

What the Attribution Pattern Means for Traders and Exchanges

Set the confirmed and strongly-suspected cases side by side and a pattern emerges that has nothing to do with exchange size or region: every one of them involved compromising the systems that approve and move funds out of cold or warm storage, not front-end user accounts. That’s a very different threat model than phishing or SIM-swapping, and it’s why exchange security disclosures increasingly emphasize multisig signer separation and hardware-based approval flows rather than just “we use cold storage” as a blanket claim.

For traders, the practical takeaway isn’t paranoia about any single platform, it’s discipline about balances. Keeping only what you need for active positions on an exchange, checking whether a platform publishes proof-of-reserves, and reading incident disclosures rather than headlines are the boring habits that actually matter here. If you’re still shopping around, our rankings of major exchanges and the individual review for Bybit cover how each platform has handled security disclosure post-incident, and the full ranked hacks list has the dollar-amount comparisons this piece deliberately left out.

Marcus Yeo — Trades perpetual futures full-time and has opened, funded and stress-tested accounts on more than 20 exchanges since 2019. Runs every withdrawal test himself.