Most Influential: The Lazarus Group

AI Summary4 min read

TL;DR

The Lazarus Group, North Korea's sanctioned hacking group, has stolen over $2 billion in cryptocurrency by mid-2025, using sophisticated methods to target exchanges and launder funds through crypto-native tools like mixers and THORChain. Their continued high-profile hacks highlight critical security vulnerabilities in the crypto industry.

Key Takeaways

•The Lazarus Group has stolen over $2 billion in cryptocurrency by mid-2025, surpassing Tesla's bitcoin holdings with stolen funds.
•They use sophisticated hacking techniques, including compromising developer machines and manipulating security interfaces, to target exchanges like Bybit and Upbit.
•The group launders stolen funds through crypto-native tools such as mixers (e.g., Tornado Cash) and THORChain, making recovery difficult.
•Their actions underscore the dual-use nature of crypto tools, where benefits for legitimate users also aid malicious actors like state-sponsored hackers.
•The ongoing hacks emphasize the need for the crypto industry to address security vulnerabilities and draw increased government and international attention.

Crypto’s most notorious hackers, the Lazarus Group, holds more bitcoin BTC$89,834.60 than Tesla — funds it stole, rather than bought. And despite efforts to tamp down on their exploits, the group continues to target legitimate exchanges and find esoteric vulnerabilities it can use to continue building the Democratic People’s Republic of Korea’s (DPRK) weapons of mass destruction program.

This feature is a part of CoinDesk's Most Influential 2025 list.

The North Korean hacking group stole $1.3 billion in cryptocurrencies in 2024. By mid-2025, it had already stolen north of $2 billion, and was on track to break its record for total funds stolen. Beyond the thefts themselves, Lazarus has taken advantage of privacy tools like mixers to launder its funds and limit recoveries by governments or its victims.

Part of the crypto movement’s appeal is the relatively easy transfer of funds, which governments cannot interfere with — but as with any other tool, this means that whatever advantages law-abiding users gain also work for malicious actors. Lazarus’ growing sophistication in targeting exchanges and other platforms, alongside the sheer difficulty the crypto industry has traditionally had in securing every last vulnerability, means that this U.S. government-sanctioned group has continued to enjoy high-profile hacks.

In 2025 alone, Lazarus has been tied to the $1.5 billion hack of Bybit in February and the $36 million hack of Upbit in November, two of the higher-profile hacks this year. Beyond the growing sophistication of its hacks — the Bybit hack, for example, saw Lazarus compromise a developer machine to manipulate a multisignature security solution’s user interface to essentially trick a user — Lazarus continues to take advantage of crypto-native tools to move its funds.

The group has in the past used mixers like Tornado Cash to move its funds and make it more difficult for governments or investigators to trace. THORChain became a key tool for Lazarus in laundering the funds stolen from Bybit.

Lazarus’ actions have drawn government attention in the past. The U.S. government briefly sanctioned Tornado Cash and secured a conviction against one of its developers, and had previously recovered other funds stolen by Lazarus. The more recent hacks continue to draw international attention, marking yet another reason the crypto industry needs to take these types of security concerns seriously.

As of October 2025, GoPlus has generated $4.7M in total revenue across its product lines. The GoPlus App is the primary revenue driver, contributing $2.5M (approx. 53%), followed by the SafeToken Protocol at $1.7M.
GoPlus Intelligence's Token Security API averaged 717 million monthly calls year-to-date in 2025 , with a peak of nearly 1 billion calls in February 2025. Total blockchain-level requests, including transaction simulations, averaged an additional 350 million per month.
Since its January 2025 launch , the $GPS token has registered over $5B in total spot volume and $10B in derivatives volume in 2025. Monthly spot volume peaked in March 2025 at over $1.1B , while derivatives volume peaked the same month at over $4B.

In her final days atop the agency, Commodity Futures Trading Commission Acting Chairman Caroline Pham announced her CEO Innovation Council, replete with crypto executives.
The names include the chief executives from Gemini, Kraken, Polymarket, Bitnomial and several others.
The CFTC is expected to get its permanent chairman very soon when the Senate votes on the confirmation of Mike Selig, President Donald Trump's nominee.

Disclosure & Polices: CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. CoinDesk has adopted a set of principles aimed at ensuring the integrity, editorial independence and freedom from bias of its publications. CoinDesk is part of Bullish (NYSE:BLSH), an institutionally focused global digital asset platform that provides market infrastructure and information services. Bullish owns and invests in digital asset businesses and digital assets and CoinDesk employees, including journalists, may receive Bullish equity-based compensation.