Lazarus Group: The Bangladesh Bank Typo, WannaCry and the $1.5B Bybit Theft

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

North Korea's Lazarus Group, which defector accounts say is known internally as the 414 Liaison Office, grew from crude website attacks into a state-run operation that steals money to fund the country's missile and nuclear programs. Gifted students are tracked from childhood into a six-year pipeline at schools such as Kim Chaek University of Technology, then often sent abroad to places like Shenyang, China, where they can work on the open internet. The group splits into units: Bluenoroff, about 1,700 members focused on financial crime, and Andariel, about 1,600 focused on espionage against South Korean government, defense and economic targets. Its record runs from the 2009 Operation Troy DDoS attacks through the 2013 DarkSeoul wiper attacks on South Korean broadcasters and banks to the 2014 Sony Pictures breach.

In 2016 the group used the Bangladesh Bank's SWIFT terminal to send 35 fraudulent transfer requests to the Federal Reserve Bank of New York for nearly $1 billion. About $81 million reached casinos in the Philippines and $20 million reached Sri Lanka, but the remaining $850 million was blocked because a word in one instruction was misspelled. The WannaCry ransomware worm followed in May 2017, built on the leaked NSA exploit EternalBlue. Then the group turned to cryptocurrency, draining $620 million from the Ronin network, $100 million from the Horizon Bridge, nearly $235 million from the Indian exchange WazirX, and $1.5 billion in Ethereum from Bybit in 2025.

• Researchers in Operation Blockbuster tied the Sony and Bangladesh Bank attacks together through reused code and a rare encryption algorithm.
• WannaCry infected about 200,000 computers in 150 countries in just over seven hours, yet collected only around $160,000 in ransom.
• Marcus Hutchins stopped WannaCry by registering a nonsense domain name for about $10, which flipped the malware's built-in kill switch.
• In 2023 blockchain security firms attributed 17.6 percent of all global crypto hacking losses to Lazarus, and the Bybit theft pushed Ethereum's price down more than 20 percent.
• Stolen funds are laundered through peel chains, cross-chain bridges, money mules, platforms such as Huione Pay and over-the-counter brokers.