The chain monitoring account Lookonchain indicates that the wallets associated with the North Korean hacker organization Lazarus were re-transferred in large amounts on August 28, with the transfer of 244.148 bitcoins. The value of the funds was approximately $1.942 million, at the price of bitcoin of approximately $795 million at the time.

At present, it is not clear to the outside world where this money is going. Lookonchain did not disclose the address of the receipt, nor did it state whether the funds went to the exchange, the currency mixer or simply to other wallets controlled by the organization. It is therefore not possible to determine, for the time being, whether Lazarus has sold the relevant bitcoin.

Second big transfer in August.

This is not the first time that Lazarus' address has changed this month. Lookonchain had previously stated on 12 August that another wallet related to the organization had been transferred out of 262.2 bitcoins, with a value of approximately $16.64 million, to a new creation address.

If the market value at the time of the two transfers were estimated, the total amount of the two bitcoin transfers that had been traced during the month of August exceeded $36 million. However, there is currently no publicly available information to confirm that the two funds come from the same balance and that the use is consistent.

Bybit's stolen assets are still being tracked. Medium

The focus on this type of address activity is related to the ongoing theft of Bybit. Bybit had sued North Korea and Lazarus Group in the United States Federal Court in Washington on 7 August for recovery of assets related to the $1.5 billion theft.

The United States federal judge subsequently issued a preliminary injunction restricting the transfer, sale or disposal of part of the assets of an unidentified defendant. Public information indicates that the civil action proceeded separately from the ongoing criminal investigation in the United States. The effect of the preliminary injunction is to temporarily preserve the property in question and does not amount to a final decision in the case.

The FBI had previously attributed the attack on Bybit in February 2025 to Trader Traitor from a Korean background. According to the FBI, the assailants converted some of the stolen assets into assets such as bitcoin and spread them over thousands of addresses on multiple block chains to make tracing more difficult.

Fragmentation of funds makes tracking more difficult

Chief Executive Officer Bybit Ben Zhou had previously indicated that, by April 2025, approximately 27.6 per cent of stolen funds could no longer be traced. It was reported that the chain of analysis had significantly increased since the assets had been removed to a large quantity of bitcoin wallets.

Chainalysis estimates that Korean hackers stole at least $202 billion of encrypted assets in 2025, an increase of 51 per cent over the previous year. The Agency also stated that the DPRK ' s actions accounted for 76 per cent of the value of the damage caused by the attacks on encryption services in that year.

Apart from historical cases, Lazarus-related attacks continued in 2026. In April, KelpDAO was attacked on the Layer Zero-based cross-chain bridge, resulting in the loss of approximately 11.65 million rsETHs at the current price of approximately $292 million. Follow-up has shown that parts of them that have not been frozen continue to be transferred through tools such as THORchain, Wasabi, Tornado Cash and Umbra.

United States sanctions are still in force.

The Office of Overseas Assets Control of the United States Department of the Treasury placed Lazarus Group on the sanctions list as early as 2019 and identified Lazarus, Bluenoroff and Andariel as being associated with the General Reconnaissance of Korea. Under current United States regulations, United States individuals and agencies are normally prohibited from dealing with sanctioned entities, and property that enters the United States or falls under United States control is also subject to freezing and reporting.

This means that where the relevant bitcoin flows to a platform or service provider under United States supervision, compliance agencies theoretically need to impose restrictions. This is also why every shift in the large money chain raises the market ' s interest in subsequent flows and the way forward.