Blog

Lazarus Group, the North Korean government-backed hacker group that hacked into Bybit and stole Ethereum tokens worth $1.5 billion, should be the most successful fraudsters in the world.

The world was once again rocked by the news of a massive heist involving Lazarus Group, a North Korean government-backed hacker collective, which stole a staggering $1.5 billion in Ethereum tokens from the popular cryptocurrency exchange Bybit. This recent attack is not an isolated incident—Lazarus has been wreaking havoc on global financial institutions for years. They are notorious for their sophisticated, calculated attacks on crypto exchanges, banks, and other entities that hold large amounts of financial assets. To put it simply, they are so successful and prolific that, in some circles, even Nigeria’s infamous “Yahoo boys” (a term for internet fraudsters) are said to be learning from them.

But comparing Lazarus to Nigerian Yahoo boys is an insult—one that these local fraudsters should never accept. Lazarus is a different breed of hacker group, one that operates with the precision of a well-oiled machine, using advanced cyber tactics and resources to pull off high-profile heists that often amount to billions of dollars each year. Unlike their Nigerian counterparts, who primarily engage in smaller-scale scams, Lazarus has reached global prominence, and their targets span continents, ranging from international banks to crypto exchanges. They are highly organized, ruthless, and most importantly—backed by the North Korean government, which gives them both the resources and the protection necessary to carry out their operations with impunity.

In fact, Lazarus Group is considered one of the most successful fraudsters in the world. Their annual earnings, often estimated to exceed $5 billion, come from a combination of hacking, theft, and sophisticated fraud schemes. They don’t just steal; they are experts at laundering the stolen money across multiple jurisdictions, making it almost impossible to trace their illicit gains. Every time they pull off a heist, it’s business as usual for them. For Lazarus, taking down a crypto exchange or siphoning funds from a bank is just another day in the office. They’ve made headlines for attacks on high-profile targets, and they’ve become almost untouchable in the cybercrime world.

Yet, despite their continued success, the Lazarus Group remains largely unscathed, raising one very important question: Why has the U.S. government and the FBI not done more to take them down?

This question is as perplexing as it is alarming. Lazarus is not just a threat to the cryptocurrency world but to global cybersecurity as a whole. They’ve been responsible for several high-profile cyberattacks and have managed to evade capture despite numerous efforts to track them down. So, what is it that makes them so elusive, and why has the global community—particularly the United States—been unable to stop them? Let’s dive deeper into the nature of Lazarus Group’s operations, their tactics, and the geopolitical factors that contribute to their continued success.

A Legacy of Cyber Heists

The Lazarus Group’s operations date back at least a decade, and their first major hack put them on the map in 2014. That year, they were linked to the Sony Pictures hack, where sensitive information about Hollywood films, employees, and internal documents was stolen and leaked online. This attack was one of the first indicators that Lazarus had the capability and the motive to cause significant damage on a global scale.

Since then, Lazarus has refined their techniques and expanded their targets. In addition to high-profile attacks on corporations, they have also taken aim at the global banking system and cryptocurrency exchanges. For instance, in 2021, Lazarus attempted to steal almost $1 billion from the Bangladesh central bank. Although the heist was thwarted after the transactions were flagged by the banking system, the incident demonstrated the group’s audacity and operational scale. They don’t just hack small exchanges or obscure targets; Lazarus has targeted some of the most prominent financial institutions in the world, including large-scale cyberattacks on major international banks.

The group’s success is no accident. Lazarus employs a combination of advanced cyber tactics and insider information to conduct their operations. They specialize in spear-phishing, social engineering, and exploiting vulnerabilities in both software and human behavior. By targeting high-ranking officials within organizations and gaining access to internal systems, Lazarus can execute its attacks with brutal efficiency.

The $1.5 Billion Heist at Bybit

One of Lazarus’ most recent attacks took place just yesterday, when they successfully breached the security infrastructure of Bybit, one of the leading cryptocurrency exchanges in the world. In a carefully orchestrated move, Lazarus stole Ethereum tokens worth $1.5 billion, and yet, in their eyes, it was merely another routine operation. For the Lazarus Group, executing a hack of this scale is almost a mundane activity, something they’ve done countless times before.

The key to their success in this attack lies not in the software vulnerabilities or flaws within the exchange’s codebase, but in their ability to manipulate the human element. Lazarus did not break the code—they broke the people. Bybit’s security relied on a multisig wallet, which requires multiple signers to approve any large transactions. But Lazarus, ever meticulous in their planning, knew how to compromise those who held the keys to the wallet. They exploited weaknesses in the human element, using social engineering techniques to manipulate the signers into approving the transaction. With all signers in agreement, the attack went unnoticed until it was too late.

For Lazarus, the $1.5 billion theft was just business as usual. Their operational capabilities are so refined that they know exactly how to exploit even the most advanced security measures. This level of sophistication has led to some serious concerns within the cryptocurrency community, as Bybit is not the only platform to be targeted. Other crypto exchanges, banks, and financial institutions have also fallen victim to Lazarus, and the group’s ability to launder stolen funds through various channels makes it incredibly difficult to trace and recover the stolen assets.

Lazarus Group’s Funding and Political Protection

One of the most important factors that sets Lazarus apart from other hacker groups is their backing by the North Korean government. Unlike smaller hacker organizations that may operate on the fringes of the criminal underworld, Lazarus has the full support and resources of a state sponsor. This gives them access to more sophisticated tools, better funding, and the protection of a nation-state. North Korea’s regime has long used cybercrime as a tool to generate revenue, circumvent economic sanctions, and fund illicit activities. Lazarus has played a crucial role in this strategy, stealing funds that are used to prop up the regime’s activities.

The North Korean government has been accused of using Lazarus as a cyber warfare unit, launching attacks on international targets to destabilize economies, gather intelligence, and fund government activities. This political backing provides Lazarus with a level of protection that most cybercriminal groups do not enjoy. Even if law enforcement agencies, including the FBI, were to pinpoint Lazarus’s activities, taking down a state-backed hacker group with such deep connections to North Korea would require an entirely different level of international cooperation.

Furthermore, North Korea has a long history of deflecting blame and denying its involvement in criminal activities. The country’s isolationist stance and authoritarian regime make it difficult for the international community to hold them accountable for the actions of groups like Lazarus. Even when evidence points directly to Lazarus, there’s little that the FBI or other agencies can do to apprehend them without risking a larger geopolitical conflict.

The U.S. Government and FBI Response: Why Haven’t They Acted?

Given the global scale of Lazarus Group’s activities and the immense financial damage they’ve caused, many are left wondering why the U.S. government and the FBI haven’t done more to take them down. The truth is that while the U.S. and other Western governments have taken steps to track and expose Lazarus’s operations, there are significant challenges when it comes to actually apprehending the group.

Here are some key reasons why Lazarus has been so difficult to take down:

1. Geopolitical Tensions: North Korea’s political isolation and its strained relationship with the United States complicate efforts to address Lazarus’s activities. Taking direct action against Lazarus could potentially lead to broader geopolitical conflict, especially given the current tensions between the U.S. and North Korea.
2. International Legal Limitations: While the FBI and other agencies have made efforts to disrupt Lazarus’s operations, the legal and logistical hurdles involved in prosecuting a state-backed hacker group are immense. The jurisdictional challenges, coupled with North Korea’s lack of cooperation with international law enforcement, make it difficult to hold Lazarus accountable.
3. Lack of Immediate Economic Consequences: North Korea is already under heavy sanctions, and Lazarus’s stolen funds are often used to fund the regime’s activities. For the North Korean government, Lazarus’s hacks provide a crucial source of revenue, making it less likely that they will take any meaningful action to stop the group.
4. Technical Challenges: Lazarus’s ability to operate in the shadows, using sophisticated cyber techniques and advanced methods of money laundering, makes it incredibly difficult for law enforcement to trace their activities. They are well-funded, highly skilled, and have the advantage of time, which allows them to evade capture.

Conclusion: Lazarus Group’s Unstoppable Path

Lazarus Group is one of the most dangerous and elusive cybercriminal organizations in the world. Backed by the North Korean government, they operate with impunity, conducting high-profile heists with brutal efficiency. Their recent attack on Bybit is just another chapter in their long history of cybercrime, and they show no signs of slowing down.

While governments around the world, including the FBI, have made efforts to track and dismantle Lazarus, the geopolitical challenges and sophisticated tactics employed by the group make them almost untouchable. As long as North Korea continues to shield them, and as long as Lazarus is able to exploit vulnerabilities in global cybersecurity systems, they will remain a major threat to the world’s financial infrastructure.

The real question now is not if Lazarus will strike again—but when and where they will strike next. And more importantly, whether the global community will be able to stop them before they cause even more damage.