Is $11.87 billion the amount Lazarus stole in 2026 alone?

No. It is a cumulative lifetime total covering roughly eight years of attributed thefts, including the Ronin bridge drain in 2022 and multiple exchange hot-wallet breaches since.

How does Lazarus launder stolen crypto?

Primarily through sanctioned mixers like Tornado Cash and Sinbad, cross-chain bridges, and Chinese OTC desks, per US Treasury filings and Chainalysis reporting.

Which coins are most exposed?

Ether and stablecoins dominate the stolen pool because bridges and DeFi venues are the main targets. Bitcoin shows up mostly after conversion for off-ramping.

Lazarus Group Has Stolen $11.87B in Crypto, Equal to 45% of North Korea's GDP, Report Finds

Market impact

Direct price impact from the disclosure itself is limited. The number is a cumulative tally, not a fresh exploit, and the market has priced each individual hit on the day it happened. The second-order impact is where the risk sits.

Bridge TVL has been contracting through 2026, with Chainalysis flagging a 38% year-over-year drop in cross-chain volume routed through non-KYC venues. If Treasury's OFAC adds another mixer or bridge frontend to the SDN list this quarter, expect another leg down in bridge TVL and a widening of the basis between native and wrapped assets on affected chains. Exchanges with the thinnest compliance stacks, mostly offshore venues already under FinCEN pressure, carry the most tail risk.

Coinbase, Kraken, and Binance. US have already tightened deposit screening in response to the TraderTraitor campaign flagged by the FBI in September.

North Korea's Lazarus Group has stolen roughly $11.87 billion in cryptocurrency to date, a figure equal to about 45% of the country's annual GDP, CryptoBriefing reported on Monday. The tally covers a years-long campaign of exchange breaches, bridge exploits, and private-key compromises attributed to the state-backed hacking crew. The disclosure lands as compliance teams at major venues brace for a fresh round of sanctions scrutiny from US and allied regulators.

By Rahul Mehta· AI-assisted· Altcoins & DeFi

What happened

CryptoBriefing on Monday published a running tally that puts Lazarus Group's lifetime crypto theft at $11. 87 billion, drawing on blockchain forensics and prior US Treasury attributions. The figure covers exchange breaches, DeFi bridge exploits, and private-key compromises stretching from the 2018 Coincheck-era intrusions through the 2022 Ronin bridge drain of $625 million and this year's string of hot-wallet hits.

North Korea's nominal GDP sits near $26. 3 billion, per South Korea's central bank, which means the stolen crypto equals roughly 45% of a full year of the country's measured output. Lazarus, also tracked by Mandiant and Chainalysis under names including APT38 and TraderTraitor, operates under the DPRK's Reconnaissance General Bureau and has been sanctioned by the US Treasury since 2019.

Why it matters

The headline reads bullish because it quantifies demand. A single state actor is pulling eleven-figure sums from the market and funnelling them through mixers, cross-chain bridges, and OTC desks. That is not a bull case.

It is a tax. Every dollar Lazarus launders is a dollar of selling pressure that recycles through the stack, usually via Tornado Cash forks, Sinbad, and Chinese OTC rails before it ever hits a cold wallet. The scale, $11.

87 billion, is now larger than the market cap of all but roughly 25 cryptocurrencies. It also hands regulators a ready-made case for tighter rules on self-hosted wallets and bridges. The FATF has flagged DPRK proceeds in each of its last three updates, and the EU's MiCA travel-rule provisions take full force in late 2026.

Market impact

Lazarus Group Has Stolen $11.87B in Crypto, Equal to 45% of North Korea's GDP, Report Finds

What happened

Why it matters

Market impact

What to watch

Disclaimer

Key takeaways

Frequently asked

Sources