Wallets attributed to the North Korea-linked Lazarus Group transferred 244.148 Bitcoin, worth approximately $19.42 million, on August 28. The movement drew renewed attention to labeled wallets tied to the sanctioned hacking operation amid ongoing efforts to trace stolen cryptocurrency. Because Bitcoin transactions are recorded on a public ledger, blockchain-analytics firms can flag and follow addresses tied to known actors even years after a theft, although the trail often complicates once funds pass through mixers or cross-chain bridges.

In an X post, Lookonchain noted that the wallets had become active roughly an hour earlier. The firm did not identify the receiving address or indicate whether the funds reached an exchange, a mixer, or another wallet. The transaction by itself does not establish a sale or cash-out attempt.

The Lazarus Group hackers are active again, transferring 244.148 $BTC ($19.42M) an hour ago. pic.twitter.com/OaJehtXnNa — Lookonchain (@lookonchain) August 28, 2026

A separate large movement occurred earlier in August. On August 12, an attributed wallet sent 262.2 BTC, valued at approximately $16.64 million at the time, to a new address.

At their reported values, the two August transactions involved more than $36 million combined. However, no available source has confirmed that they originated from the same balance or served a shared purpose.

Bybit Lawsuit Adds Pressure on Lazarus Group

Bybit filed a lawsuit on August 7 against North Korea, the Reconnaissance General Bureau (RGB), and the Lazarus Group in an effort to recover assets associated with the $1.5 billion Bybit hack. The RGB, which the U.S. Treasury Department describes as North Korea's primary intelligence agency, was listed as a defendant in the case filing. A restraining order limits the disposition of the identified assets while the case proceeds. Legal actions of this kind are a notable shift for an industry where hacked funds have historically been difficult to recover, particularly when a defendant is a state actor already under international sanctions.

The FBI attributed the attack in February 2025 to North Korea-based actors tracked as TraderTraitor, stating that the hackers converted some of the stolen assets into Bitcoin and other cryptocurrencies. The funds were dispersed across thousands of addresses on multiple blockchain networks. In April 2025, Bybit CEO Ben Zhou said that 27.6% of the stolen funds had disappeared.

Lazarus Group-Linked Attacks Continued in 2026

According to Chainalysis, North Korean hackers stole at least $2.02 billion in cryptocurrency in 2025, a 51% increase over the previous year's losses. The firm put their cumulative cryptocurrency thefts at no less than $6.75 billion.

Further activity took place in April 2026, when hackers siphoned roughly 116,500 rsETH from the KelpDAO LayerZero bridge. According to the LayerZero report, the loss amounted to approximately $292 million and was carried out by TraderTraitor. Chainalysis said the criminals compromised the infrastructure that fed data into the bridge's verification system; falsified data indicated a token burning that never occurred, after which the Ethereum contract released the tokens to the hacker's address.

Rapid intervention prevented additional thefts worth $95 million, and the Arbitrum Security Council blocked 30,766 ETH involved in downstream transactions. That response illustrates a broader industry trend of exchanges, blockchain-analytics firms, and governance bodies coordinating to freeze stolen assets before they can be laundered.

The U.S. Treasury Department sanctioned the Lazarus Group in September 2019 due to its connections with the RGB. Property covered by the sanctions and under U.S. control must be blocked and reported to OFAC, and federal rules generally prohibit U.S. persons from dealing with designated entities. As the Bybit case proceeds and on-chain investigators continue to track attributed wallets, further movements from labeled addresses are likely to keep drawing public scrutiny.