Lummis Pushes CLARITY Act as Answer to Lazarus Group's $6.75B Crypto Theft Record

Senator Cynthia Lummis (R-WY) is making North Korea's Lazarus Group the centerpiece of her case for the CLARITY Act, arguing the stalled legislation contains the most direct enforcement mechanism Congress has yet produced to cut state-sponsored hackers off from digital asset markets.

The Lazarus Group, a cybercriminal organization attributed to the North Korean government, has stolen approximately $6.75 billion in cryptocurrency across years of exchange breaches, protocol exploits, and social engineering campaigns. Lummis is framing that number as the cost of the regulatory gaps the CLARITY Act is designed to close.

"The CLARITY Act's three illicit-finance provisions are the strongest tool to cut the Lazarus Group off from crypto markets."

Senator Cynthia Lummis (R-WY)

The bill's core enforcement mechanism gives both the U.S. Treasury Department and crypto exchanges new authority to freeze suspicious transactions before funds can be moved offshore or laundered through mixers and cross-chain bridges. That pre-movement freeze authority is a meaningful departure from the current framework, which relies primarily on the Office of Foreign Assets Control (OFAC) designating wallet addresses after funds have already moved. By the time OFAC lists an address, the assets are often already fragmented across dozens of wallets or converted into other tokens.

"The CLARITY Act closes illicit-finance gaps that groups like North Korea's Lazarus Group have exploited, arguing the bill hands the U.S. Treasury Department and crypto exchanges new authority to freeze suspicious transactions before funds move overseas."

Senator Cynthia Lummis (R-WY)

The Lazarus Group's operational history illustrates exactly why the existing reactive model has struggled. The group first drew widespread attention with the 2016 Bangladesh Bank heist, which routed roughly $81 million through the SWIFT network. Its pivot to cryptocurrency followed the money: as DeFi protocols accumulated billions in liquidity through the early 2020s, Lazarus adapted accordingly, targeting cross-chain bridges and exploiting smart contract vulnerabilities to drain funds at scale. The 2022 Ronin Network breach alone accounted for $625 million. OFAC designations followed each incident, but recovery rates remained negligible.

The CLARITY Act's three illicit-finance provisions are designed to interrupt that cycle at the point of transaction rather than after the fact. The broad architecture involves exchange-level reporting obligations, expanded Treasury coordination authority, and the pre-emptive freeze mechanism. Together, they would create a compliance layer that applies to regulated crypto businesses operating in U.S. markets, forcing Lazarus-linked activity through chokepoints where it can be intercepted.

The legislative path, however, is not clear. Senate action on the CLARITY Act is currently stalled, and the bill faces friction from multiple directions. Privacy advocates and decentralization-focused industry participants have raised concerns that broad transaction-freeze authority could produce false positives, sweeping legitimate users into enforcement actions. Automated compliance systems flagging transactions based on behavioral heuristics have a documented history of errors, and the asymmetry of harm falls on ordinary users who lack the legal resources to contest a freeze quickly.

A harder structural problem also exists. The CLARITY Act binds regulated exchanges operating under U.S. jurisdiction. Lazarus Group operations frequently route through non-compliant infrastructure, including decentralized exchanges (DEXs) with no KYC requirements and peer-to-peer markets outside U.S. reach. The bill's effectiveness at the margin depends on whether regulated venues remain a necessary part of the laundering chain, a condition that sophisticated state actors have shown they can work around.

International coordination compounds the challenge. North Korean sanctions evasion has persisted in part because enforcement is uneven across jurisdictions. A U.S. law that tightens domestic exchange compliance does not automatically constrain exchanges domiciled in jurisdictions with weaker AML frameworks. Lummis has pointed to the bill's potential to set global norms, but norm-setting through unilateral legislation is a slow process with no guaranteed uptake.

The $6.75 billion figure attributed to Lazarus Group activity represents a sustained, state-directed campaign against a financial infrastructure that currently lacks the statutory tools to respond in real time. The CLARITY Act's pre-movement freeze authority, if enacted and enforced, would represent the most operationally significant upgrade to the U.S. crypto sanctions toolkit since OFAC began designating digital asset addresses in 2018. Whether the Senate moves the bill forward before the current session closes is the more immediate question.