How Lazarus Group Hacks Crypto Companies: The 2026 Playbook
Quick answer. Mostly through people: fake recruiters get engineers to run malware, fake investors win signers' trust, and attackers move on to cloud accounts and signing systems. TRM Labs counts only 13 code exploits in 100 North Korean incidents.
Video transcript
North Korea's Lazarus Group mostly hacks people, not code. TRM Labs counts only 13 code exploits in 100 North Korean incidents.
TRM counts about 12.8 billion dollars stolen since 2017, with 7.4 billion of it in 2026.
Most cases start with a person. Fake recruiters send malicious coding tests. Fake investors spend months earning trust. Poisoned packages open other doors.
TRM calls the next stage Code to Custody. One infected laptop yields SSH keys and cloud tokens, which lead to cloud accounts and signing systems.
At Bybit, a tampered Safe wallet interface disguised a transaction. At Drift, two Security Council members pre-signed admin handovers. At Binance, the attacker reached a signing service.
After the theft, laundering takes weeks. Chainalysis describes a 45-day cycle. DeFi and mixers first, then exchanges and bridges, then no-KYC exchanges and guarantee services.
Assume one engineer's laptop will be compromised. Then make sure it cannot reach a signature.
Run outside code in a VM on a non-company device. Keep deploy tokens off daily laptops. Verify on a dedicated device, and timelock admin actions.
Guardian's OpSec Audit maps every path to your funds. Managed Security reviews every multisig transaction before signing. Sentry adds offchain monitoring, backed by an MDR team on a 15-minute SLA for Critical alerts.
Read the full playbook, or talk to Guardian about closing that path to your keys.
Lazarus Group is the name most people use for North Korea's state hackers. Agencies and researchers split that activity into units with their own names.
The target is money. TRM Labs counts about $12.8 billion stolen by North Korea-backed hackers since 2017, $7.4 billion of it in 2026.
This guide maps the tactics behind Bybit, Drift and Binance to defenses. Every attribution is the named agency's or researcher's.
Who Lazarus Is
In 2019, the US Treasury sanctioned Lazarus Group, Bluenoroff and Andariel. It said all three are controlled by the Reconnaissance General Bureau, North Korea's main intelligence agency.
In 2022, the FBI, CISA and Treasury warned of TraderTraitor, their name for trojanized crypto apps used against blockchain firms. They listed Lazarus Group, APT38, BlueNoroff and Stardust Chollima as industry names.
Investigators use their own labels:
| Name | Used by | Linked to |
|---|---|---|
| TraderTraitor | FBI | DMM Bitcoin (2024), Bybit (2025), Binance (2026) |
| Jade Sleet, UNC4899, Slow Pisces | Other trackers, per BleepingComputer | The same group as TraderTraitor |
| UNC6862 | Mandiant, per Drift | Drift (April 2026) |
| Contagious Interview | Unit 42, Socket | Fake job interviews and npm packages |
Totals depend on who counts, but the method is consistent:
- TRM Labs: about $12.8 billion, with data through October 29, 2026, Binance included.
- Chainalysis: at least $2.02 billion in 2025, in its December 18, 2025 report.
- TRM: only 13 of its 100 attributed incidents were code exploits.
- TRM: attacks on keys, servers and signing systems were about 88% of value, Binance included.
Initial Access: Social Engineering
Most cases start with a person. The FBI warned in 2024 that North Korean actors study targets' professional profiles, then build lures around jobs or investment.
Fake recruiters and coding tests
At DMM Bitcoin, a fake LinkedIn recruiter sent an employee of wallet firm Ginco a coding test with malicious Python, the FBI said, as BleepingComputer reported.
The attackers moved from there into DMM and took about $308 million in May 2024. The FBI attributed the theft to TraderTraitor.
Binance describes the same lure in 2026: a fake "Project Director" sent an engineer an "assignment" containing a malicious repository. See fake job interviews and coding tests.
Fake investors and trading firms
At Drift, attackers posed as a quantitative trading firm. Chainalysis says they met contributors at conferences over about six months and deposited over $1 million in a Drift vault.
Drift's April 5 update said the people met in person were not North Korean nationals, Nexus Mutual reports. Drift later said Mandiant attributed the attack to UNC6862, a North Korean group.
Poisoned packages and tools
- npm packages: 35 in one Contagious Interview wave, including lookalikes such as reactbootstraps (Socket, 2025).
- Tampered installers: Binance says an engineer downloaded a tampered Homebrew installation in June 2026.
- Trojanized apps: fake crypto trading apps built on Electron (TraderTraitor advisory, 2022).
- Editor tasks: repos whose VS Code tasks run on folder open once trusted (Jamf, 2026).
Some get hired instead. Chainalysis says North Korea embeds IT workers in crypto services; see how to spot North Korean IT workers.
Signer and UI Compromise
Malware on one laptop is the start. TRM calls the route onward "Code to Custody": the malware yields SSH keys, session cookies and cloud tokens.
Bybit: the wallet interface
In February 2025, a Safe{Wallet} developer's Mac was compromised through a Docker project, The Hacker News reported. Safe says the attackers hijacked AWS session tokens to get past MFA.
Safe says the compromise led to "the proposal of a disguised malicious transaction," which Bybit's signers approved. Sygnia traced it to JavaScript served from Safe's AWS S3 bucket.
The FBI puts the theft at about $1.5 billion and calls the activity TraderTraitor; Safe's statement named the Lazarus Group. See our Bybit hack explainer.
Drift: the signers themselves
Two of Drift's five Security Council members pre-signed transactions that handed over admin control. Solana durable nonces kept them valid until the attacker submitted them on April 1, 2026.
Chainalysis estimates about $285 million was drained. See our Drift exploit breakdown.
Binance: the signing service
Binance says the attacker spread from the compromised computer to two more engineers, one holding a container deployment token. On October 29, 2026, it reached an internal wallet signing service.
TRM counts about $6.36 billion taken. The FBI attributed it to TraderTraitor; Binance cites the FBI but makes no attribution itself. See our Binance hack explainer.
Laundering
The theft can take minutes; the laundering takes weeks. Chainalysis describes a typical 45-day cycle in three waves:
| Days after the theft | Where the funds go, per Chainalysis |
|---|---|
| 0 to 5 | DeFi protocols and mixers |
| 6 to 10 | Exchanges and cross-chain bridges |
| 20 to 45 | No-KYC exchanges, guarantee services, Chinese-language platforms |
Chainalysis says North Korea leans harder than other thieves on Chinese-language guarantee services, bridges and mixers. Just over 60% of its volume moves in transfers under $500,000.
TRM adds Tornado Cash funding before Binance, peel chains, THORChain swaps into bitcoin after Bybit, and Chinese OTC brokers who buy at a discount.
Speed counts on defense too. The FBI asks exchanges and DeFi services to block listed laundering addresses: 628 for Binance, BleepingComputer reported.
Stablecoins can be frozen. TRM says about $2.7 billion of the Binance theft was frozen within hours.
About $2.4 billion in ETH and BTC was beyond issuers' reach, TRM says.
Defenses for Each Tactic
Assume one engineer's laptop will be compromised. Then make sure it cannot reach a signature.
| Tactic | Defense |
|---|---|
| Recruiter's coding test | Outside code only in a VM on a non-company device |
| Fake investor or partner | Verify identity on a separate channel |
| Poisoned packages and installers | Primary sources only; allowlist approved apps |
| Laptop to cloud and deploy tokens | No deploy tokens or signing access on daily laptops |
| Tampered signing screen | Verify on a dedicated device, outside the main interface |
| Pre-signed approvals | Timelocks on admin actions; durable nonces off (Solana) |
| Signing service reached | Policy enforced at the signer; signing split by chain and tier |
| Laundering | Screen deposits against North Korea labels; rescreen as labels change |
The FBI, Microsoft and TRM add these checks.
- Keep seed phrases and wallet logins off internet-connected devices (FBI).
- Require approvals from several unconnected networks before moving company funds (FBI).
- Open unfamiliar repos untrusted: VS Code never runs automatic tasks in an untrusted workspace (Microsoft).
- Alert on EIP-7702 delegations on treasury wallets, and keep a tested revocation (TRM).
How Guardian Helps
Guardian's OpSec Audit maps every path to your funds and who can walk it, including what it takes to slip a malicious payload past a signer.
Managed Security keeps that map current. Its security operations team reviews every multisig transaction before it is signed, and every deployment and configuration change as it lands.
Offchain, Guardian's Sentry watches domains, DNS, certificates, cloud and code host. A 24/7 MDR team works to a 15-minute SLA on Critical alerts.
Frequently Asked Questions
Is Lazarus Group the same as TraderTraitor?
Not exactly. Lazarus Group is an industry name for North Korean state hackers. TraderTraitor began as the US government's name for this campaign's trojanized crypto apps, and the FBI uses it for the activity behind Bybit and Binance.
How much crypto has North Korea stolen?
TRM Labs counts about $12.8 billion since 2017, with $7.4 billion of it in 2026, using data through October 29, 2026. Chainalysis counted at least $2.02 billion stolen in 2025, in its December 18, 2025 report.
How does North Korea launder stolen crypto?
Chainalysis describes a cycle of about 45 days: DeFi and mixers first, then exchanges and bridges, then no-KYC exchanges and Chinese-language guarantee services. TRM also sees peel chains, swaps into bitcoin and OTC brokers.
What is the best defense against Lazarus Group attacks?
Assume one engineer's laptop will be compromised, and make sure it cannot reach a signature. Run outside code in a VM on a non-company device, keep deploy tokens off daily laptops, verify on a dedicated device and use timelocks.
Sources
- FBI (IC3): North Korea Responsible for $1.5 Billion Bybit Hack (February 26, 2025)
- FBI (IC3): North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks (September 3, 2024)
- CISA, FBI and Treasury: TraderTraitor, North Korean State-Sponsored APT Targets Blockchain Companies, AA22-108A (April 18, 2022)
- US Treasury: Treasury Sanctions North Korean State-Sponsored Malicious Cyber Groups (September 13, 2019)
- TRM Labs: North Korea Has Stolen USD 12.8 Billion in Crypto, USD 7.4 Billion of It in 2026 (October 30, 2026)
- TRM Labs: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History (October 29, 2026)
- Chainalysis: North Korea Drives Record $2 Billion Crypto Theft Year, Pushing All-Time Total to $6.75 Billion (December 18, 2025)
- Chainalysis: The Drift Protocol Hack, How Privileged Access Led to a $285 Million Loss (April 9, 2026)
- Drift: Drift Recovery Update (June 3, 2026)
- Drift: Incident Recovery Update (April 16, 2026)
- Nexus Mutual: Drift Protocol Incident Report (April 9, 2026)
- Binance: 29 October 2026 Binance Security Incident, Initial Findings and Response Update (November 3, 2026)
- BleepingComputer: FBI links $6.3 billion Binance crypto heist to North Korean hackers (November 1, 2026)
- BleepingComputer: FBI links North Korean hackers to $308 million crypto heist (December 24, 2024)
- BleepingComputer: Lazarus hacked Bybit via breached Safe{Wallet} developer machine (February 26, 2025)
- The Hacker News: Safe{Wallet} Confirms North Korean TraderTraitor Hackers Stole $1.5 Billion in Bybit Heist (March 7, 2025)
- The Hacker News: North Korea-Linked Hackers Target Developers via Malicious VS Code Projects (January 20, 2026)
- Socket: Another Wave, North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages (June 25, 2025)
- Palo Alto Networks Unit 42: Contagious Interview, DPRK Threat Actors Lure Tech Industry Job Seekers (October 9, 2024)
- Visual Studio Code Docs: Tasks
- Guardian: OpSec Audit
- Guardian: Managed Security
Close the path from one laptop to your keys
Guardian maps how a compromised engineer's laptop could reach your cloud, signers and signing systems, then watches those paths around the clock.