Lazarus Group
North Korea-linked threat actor · OFAC-sanctioned · stolen funds
This is not a portfolio — it is a crime scene. Lazarus Group is the OFAC-sanctioned, North Korea-linked operation tied to the Bybit hack, and the roughly $70M tagged here is stolen money in transit, not a position anyone chose to hold. The only read that matters is direction of flow: where these coins move next, and which venues touch them.
The desk's read
The balance sits across four chains — about $50M in BTC on Bitcoin, $8M USDT on Tron, $6M on Ethereum, and $4M on BSC — but the split is a laundering map, not an allocation. Bitcoin is the holding pen; the smaller Tron, Ethereum, and BSC legs are the working layers where funds get chopped, bridged, and pushed toward mixers and swap venues. When you see BTC here start to fragment or the USDT-on-Tron leg drain, that is the laundering machine spinning up, not conviction changing.
For a desk, the exposure is compliance, not price. Anything downstream of a sanctioned Lazarus address carries OFAC taint, and centralized venues that let these coins on-ramp risk frozen deposits and regulatory blowback. The USDT position is the pressure point: Tether can and does freeze flagged addresses, so watch for freezes and for the stolen stablecoin trying to hop to fresh wallets ahead of a block. The BTC leg is the harder problem — no issuer freeze switch, so it leans on CEX chokepoints and mixer throughput.
The signal to trade is behavioral, not directional. Sudden movement out of the Bitcoin pen, new bridge activity on the ETH or BSC legs, or a burst of small structured transfers all flag an active cash-out attempt — and cash-out attempts are when funds surface on exchanges and get caught. Treat any counterparty, OTC desk, or pool downstream of these addresses as radioactive until traced clean. The job is tracing and avoidance, full stop.
What they hold
Largest token positions on-chain data maps to this entity, by USD value.
| Asset? | Chain? | Value? |
|---|---|---|
| BTC | bitcoin | $51.0M |
| USDT | tron | $7.7M |
| ETH | ethereum | $3.3M |
| BNB | bsc | $2.9M |
| USDT | ethereum | $1.6M |
| BUSD | bsc | $640K |
| USDC | ethereum | $544K |
How to read a row → BTC · bitcoin · $51.0M: this entity's largest position is $51.0M of BTC held on bitcoin. Rows are sorted by USD value, so the top row is the biggest bet.
By chain
| Network? | Value? |
|---|---|
| bitcoin | $51.0M |
| tron | $7.7M |
| ethereum | $5.9M |
| bsc | $3.6M |
How to read a row → bitcoin · $51.0M: $51.0M of the holdings live on bitcoin. Chains are ranked by value, so the top row is where most of the money sits.
Source: aggregated on-chain entity data, cross-checked against Etherscan. Balances are USD-denominated and move with price. Updated 20 Jul 2026.
Not investment advice. Entity labels are on-chain attribution and can be imperfect; a labelled balance may mix personal, treasury and custody wallets. Large balances do not imply intent — some never move.