North Korea's Lazarus Group: Espionage Funded by Cyber Theft

North Korea's Reconnaissance General Bureau (RGB) oversees the clusters publicly tracked as Lazarus, APT38, and sub-groups like Kimsuky and BlueNoroff. What sets Lazarus apart from every other state cyber programme is its dual mission: it conducts conventional espionage against defence, diplomatic, and cryptocurrency targets while also generating hard currency for the regime through bank and exchange heists.

Major operations include the 2016 Bangladesh Bank SWIFT heist (attempting to steal nearly $1 billion), the WannaCry 2017 worm, the 2022 Ronin Network theft of ~$620 million, and repeated cryptocurrency exchange compromises that, by FBI and UN estimates, have stolen billions of dollars to fund the sanctioned North Korean state.

The cryptocurrency dimension is now central to Lazarus operations. Stolen funds are laundered through mixers, cross-chain bridges, and fiat off-ramps. The group's convergence of state intelligence and criminal finance makes it a priority for both national-security and financial-crime responses, and a leading case for blockchain intelligence collaboration.