On-chain analytics firms Lookonchain and Arkham Intelligence reported that the North Korean hacking collective known as the Lazarus Group transferred 244.148 Bitcoin, valued at approximately $19.42 million, on August 28, 2026. The movement came from wallets that had been dormant and is seen as a likely early step in a laundering chain for stolen assets.
The Lazarus Group still controls a consolidated portfolio worth around $40 million. More than half is held in Bitcoin: the group's balance contains 267.526 BTC worth $20.97 million at the asset's price of about $78,380. With the latest transfer, the hackers have moved almost their entire Bitcoin reserve. In addition to BTC, the group's diversified portfolio includes 9.29 million USDT, 1,737 ETH worth about $4.3 million, and 5,024 BNB worth about $3.5 million.
Analysts say the Lazarus Group's operational pattern typically includes three stages: splitting a large amount across many addresses, mixing coins through privacy services to conceal their origin, and cashing out via over-the-counter or peer-to-peer platforms. The specific destination of the transferred Bitcoin remains unclear, but blockchain intelligence firms are actively tracking the funds.
The activity comes amid heightened international scrutiny of North Korea's cyber-enabled theft. The United Nations has cited cryptocurrency heists as a major revenue source for the regime's weapons programs. According to Chainalysis, North Korean hackers stole more than $1 billion in cryptocurrency in 2023, with similar figures projected for later years.
Although the $19.42 million transfer is small compared with Bitcoin's daily trading volume, the event highlights persistent security vulnerabilities and could add to regulatory pressure on privacy tools and exchanges. Modern AML platforms can automatically flag transactions involving tracked Lazarus Group addresses, helping exchanges block related inflows and making direct conversion to fiat more difficult. For now, analysts say it is too early to sound the alarm, but the movement remains under close observation.
