News.Bitcoin North Korea's Lazarus Group Exploits Crypto Gaps, $6.75 Billion Stolen
Article Content
- •Lazarus Group linked to $6.75 billion in crypto theft since 2019.
- •The CLARITY Act aims to enhance regulatory measures against crypto-related illicit finance.
- •North Korea's hackers were responsible for two-thirds of global crypto hacking losses in early 2026.
In 2025 and the first half of 2026, North Korea's Lazarus Group has been a major threat in the cryptocurrency sector, responsible for approximately $6.75 billion in theft. The group has exploited vulnerabilities in the crypto ecosystem, with significant attacks including the $1.5 billion hack of Bybit in February 2025 and a series of high-profile incidents in 2026, such as the $285 million theft from Drift Protocol. The total losses from crypto hacks in 2025 reached over $3.4 billion, with personal wallet compromises rising dramatically. In response, Senator Cynthia Lummis has introduced the CLARITY Act, aimed at closing regulatory gaps that allow such illicit activities. The Act would empower the U.S. Treasury to freeze suspicious transactions and impose sanctions on foreign digital asset firms. Critics argue that the legislation may inadvertently create loopholes for sanctions evasion. The ongoing threat from North Korean hackers continues to pose significant risks to the cryptocurrency industry.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (7)
Following this threat?
Track Lazarus Group, Mach-O Man and Bybit in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…
Lazarus Group Linked to PHP Vulnerability Exploitation Plans A cybersecurity report from Cyfirma indicates that a group suspected to be linked to North Korea's Lazarus Group is preparing to exploit critical vulnerabilities in PHP, specifically CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution. The attackers, communicating in Korean, are…