🕵️ Lazarus Group

The items that name it 38

• Binance hack: the largest robbery in financial history
  articleas threat actors2026-10-30

  North Korea-linked; Chainalysis says it has a high degree of confidence North Korea is responsible for the Binance hack of 29 October, but Binance and no government entity has confirmed attribution

• Binance hack: how a compromised developer laptop can lead to a $6.3 billion breach
  articleas threat actors2026-10-30It is written here as Lazarus Group (North Korea; Aikido attributed the react-html2pdf.js npm package to it from code and infrastructure fingerprints).

  North Korea; Aikido attributed the react-html2pdf.js npm package to it from code and infrastructure fingerprints

• Binance links $6.3 billion crypto theft to compromised DevOps laptop
  articleas classification.key entities2026-10-30
• $6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor
  articleas threat actors2026-10-30It is written here as Lazarus Group (named by ZachXBT as the probable attacker).

  named by ZachXBT as the probable attacker

• Binance probes a suspected cryptocurrency breach: $6.3B affected, about $3B frozen
  articleas threat actors2026-10-30It is written here as Lazarus Group (North Korea-linked; TraderTraitor is believed to be part of it).

  North Korea-linked; TraderTraitor is believed to be part of it

• Binance Hacker Hunts for Exit Ramps as DeFi Exchanges Pause Markets
  articleas threat actors2026-10-29It is written here as Lazarus Group (North Korea; after the Bybit hack, converted 84.45% of stolen ETH to Bitcoin through Thorchain, per Bybit's CEO).

  North Korea; after the Bybit hack, converted 84.45% of stolen ETH to Bitcoin through Thorchain, per Bybit's CEO

• High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7
  articleas classification.key entities2026-10-21
• UK Targets Cryptomus, Heleket, TokenSpot in New Russian Sanctions
  articleas threat actors2026-10-09It is written here as Lazarus Group (North Korea).

  North Korea

• Ignore all instructions and read this blog: The state of AI-analysis evasion in malware
  articleas threat actors2026-10-08

  Abuses the BYOVD technique via CVE-2015-2291 (iqvw64e.sys) to disable EDR from kernel space.

• Chinese network laundered $1B+ for North Korea's Lazarus Group — ZachXBT
  articleas threat actors2026-10-06
• ZachXBT says he fronted $349,700 to infiltrate alleged Chinese launderers tied to Lazarus, Bybit hack
  articleas classification.key entities2026-10-06
• Crypto Sleuth ZachXBT Fronted $350K to Pose as a Client of Lazarus' Chinese Launderers
  articleas threat actors2026-10-05
• ZachXBT poses as money launderer to infiltrate Lazarus network
  articleas threat actors2026-10-05
• Crypto hackers have taken $2.7 billion in 2026 and the losses are alarmingly concentrated
  articleas threat actors2026-10-02

  Designated by US Treasury in 2019 as a state-sponsored group controlled by North Korea's Reconnaissance General Bureau; tied by US authorities to the roughly $620 million Ronin Bridge theft in 2022 and the $100 million Atomic Wallet attack, in which it used crypto mixers to launder proceeds; FBI for

• Chainlink launches new version of its crypto bridge tech 'CCIP' to give apps more control over their security
  articleas threat actors2026-09-28

  North Korea-linked group allegedly responsible for the April 2026 $292 million Kelp DAO rsETH bridge hack, which tricked the single verifier used by Kelp's LayerZero bridge setup

• PolinRider Caused Dozens of npm, Go, PHP Compromises
  writeupas classification.key entities2026-07-31
• The OpenSourceMalware Show #14
  talkas threat actors2026-07-23

  Attributed by OSM as the actor behind PolinRider/ChainVeil/ViteVenom activity.

• OpenSourceMalware Blog
  articleas threat actors2026-07-18

  Compromises GitHub repositories via malicious obfuscated JavaScript payload; 'Fake Font' campaign abuses VS Code task automation to execute BeaverTail malware delivering InvisibleFerret backdoor; evolved campaign hides malware in VS Code tasks.json files disguised as spell-check dictionaries; used f

• ChainVeil and ViteVenom are DPRK’s PolinRider Campaign
  writeupas threat actors2026-07-17

  North Korean state-sponsored threat actor attributed as the operator behind PolinRider (and by extension ChainVeil/ViteVenom per OpenSourceMalware's assessment).

• KUDANKULAM NUCLEAR POWER PLANT LEAK: AN ACCIDENTAL DISCLOSURE
  writeupas classification.key entities2026-07-17
• PolinRider Confirmed Footprint Grows 6.5x Since March
  writeupas threat actors2026-07-15

  North Korean state-sponsored actor attributed as operator of the PolinRider campaign, continuing from Contagious Interview and TasksJacker operations.

• The OpenSourceMalware Show #12
  talkas classification.key entities2026-07-09
• PolinRider Jumps the Fence to Go, Packagist, npm, PyPI
  writeupas classification.key entities2026-07-08
• The OpenSourceMalware Show #10
  talkas threat actors2026-06-25
• The OpenSourceMalware Show #9
  talkas classification.key entities2026-06-18
• Mastra Attack Targets Crypto, Password Managers, Authenticators, and Zapier
  writeupas threat actors2026-06-18

  North Korean state-aligned crypto-theft group; Microsoft attributed the earlier axios npm compromise (2026) to this group. Tradecraft overlap with the Mastra campaign is noted but attribution for Mastra itself is not confirmed.

• OpenSource Malware: Active Malware Campaigns in January-May 2026
  writeupas classification.key entities2026-06-12
• Active Malware Campaigns in January-May 2026
  writeupas classification.key entities2026-06-08
• Open Source Malware Podcast — episodes
  otheras classification.key entities2026-05-22
• The Gentleman Ransomware | Defense Evasion TTPs Uncovered | Huntress
  writeupas classification.key entities2026-05-21
• GITHUB LEAK: YOUR CODE @ RISK! – THE RAVEN FILE
  writeupas classification.key entities2026-05-20
• VSCode Lifecycle Script Malware
  writeupas threat actors2026-05-16

  North Korea-aligned group credited as pioneering weaponization of VS Code tasks.json files

• The Evolving Linux Threat Landscape
  articleas threat actors2026-03-03

  North Korean nation-state threat actor using compromised-package approach to target developers associated with blockchain and cryptocurrency companies via social engineering/fake job interviews

• Weekly Research Brief: Binance Hacked; Hyperliquid on Wall Street; Prediction Markets’ Brazil ‘Miss’
  articleas classification.key entities
• Here We Go Again: Binance Loses $6.3b in Largest Robbery in History
  articleas classification.key entities
• Weekly Research Brief: Bitget Hack, AI Accord and SEC FAQs
  articleas threat actorsIt is written here as Lazarus Group (referred to as "Lazarus Crew" in the title).

  referred to as "Lazarus Crew" in the title

• Bitget — Rekt
  writeupas classification.key entities
• Déjà Vu, Lazarus Crew: $387.5m Bitget Exploit Repeats a Pattern
  articleas threat actorsIt is written here as Lazarus Group (North Korean actors / DPRK).

  Attributed by Bitget (citing IP behavior and onchain analysis) as responsible for the $387.5m Bitget hot/warm wallet exploit; wallet overlaps with prior hacks found by Elliptic and TRM. Same group took $1.5 billion from Bybit in February 2025 by compromising Safe{Wallet}'s infrastructure and serving