Actor · non-state · Transnational & Hybrid
North Korean hackers (Lazarus)
Assessed 15 September 2026
Assessment
DPRK-linked actors stole 2.02 billion dollars in 2025, a 51 percent year-on-year rise taking the cumulative total to roughly 6.75 billion dollars, and accounted for 76 percent of all crypto hack value through April 2026 on the strength of two attacks. The roughly 290 million dollar KelpDAO theft in April, attributed to Lazarus, remained the largest 2026 exploit through Sept 15, with no new major DPRK heist publicly reported.
Recent, assessed
- 2026-09-09Xinbi Guarantee designated. chainalysis.com
Level history
Levels set by research reviews. A level set by hand is shown at the top of the page while it is in force and is not part of this history.
| Date | Level | Review |
|---|---|---|
| 2026-09-15 | 3 | Weekly review |
| 2026-09-14 | 3 | Weekly review |
| 2026-09-12 | 3 | Weekly review |
| 2026-09-12 | 3 | Baseline |
Latest headlines 5
Matched to this entry by keyword from the pull of 19 Sep, 11:09 UTC. Not reviewed; some may be off-topic.
- North Korean Hackers Targeted IT Professionals with Fake Job Listings and Stole Data from 7,000 Crypto Wallets
- North Korean hackers behind crypto thefts across 100 countries, including Japan
- North Korean hackers disguise cyberattacks as job interviews with AI
- International security agencies warn about North Korean hackers exploiting job seekers to steal crypto, data
- North Korean hackers infect thousands of devices across 100 countries as part of ‘WaterPlum’ campaign