The infamous Lazarus Group continues to make waves in the crypto space, carrying out sophisticated hacks and amassing billions in profits over the years. Recently, blockchain analysis firm SpotOnChain detected movement in a wallet allegedly linked to the North Korean hacking syndicate, revealing a significant asset swap.
According to SpotOnChain, the wallet in question offloaded 40.778 Wrapped Bitcoin (WBTC) and acquired 1,847 Ethereum (ETH). Following the transaction, the ETH was then distributed across three different wallets. The firm noted in an April 3, 2025, post on X that the group had initially purchased the WBTC for $999,900 USDT at a price of $24,521 per token in February 2023. Just 12 hours prior to the report, they liquidated their holdings for 1,857 ETH at $86,170 per token, netting a substantial $2.5 million profit in the process.
With a history of holding assets long-term before strategically cashing out, Lazarus Group has leveraged volatile crypto markets to its advantage. The group is believed to control digital assets worth over $15 billion, with major holdings in Bitcoin (BTC), Ethereum (ETH), Tether (USDT), USD Coin (USDC), XRP, Binance Coin (BNB), and Solana (SOL). Ethereum remains the most significant portion of their portfolio, with some estimates placing their ETH holdings at more than $4 billion alongside approximately 70,000 BTC.
Since early 2024, wallets tied to the hacking collective have periodically liquidated or swapped assets, capitalizing on market surges. CoinMarketCap reports that WBTC is currently trading at $83,402, reflecting a 1.74% intraday decline. The asset’s market capitalization sits at $10.76 billion, marking a 1.72% drop. Despite recent fluctuations, WBTC remains up by 25.43% over the past 52 weeks, though it has fallen 4.48% from its all-time high of $108,307 recorded on January 20, 2025.
The broader cryptocurrency market has suffered substantial losses in Q1 2025, shedding over $1.5 billion in value. Of this, Bybit alone accounted for approximately $1.4 billion in losses. A recent Chainplay report highlights that 83% of crypto traders and investors have been affected by fraudulent activities, with centralized exchanges bearing the brunt of financial thefts.
Cybercrime within the crypto sector has taken various forms, including phishing schemes, flash loan attacks, social engineering scams, and romance fraud. Additionally, rug pulls, Ponzi schemes, fake trading platforms, and giveaway scams have proliferated. SIM-swapping incidents have also been reported, leading to several arrests linked to these fraudulent operations.
As authorities and industry leaders work to combat these cyber threats, Lazarus Group remains a dominant force in crypto crime, leveraging market volatility to sustain its illicit operations.
By Alejandro Silva Ramírez, Crypto Analyst & Columnist