lazarus

Tin tức từ ChainCatcher, theo dõi của Lookonchain, nhóm hacker Lazarus đã chuyển 244.148 Bitcoin, trị giá 19.42 triệu USD.

Theo thông tin từ ChainCatcher, theo dõi của nhà phân tích trên chuỗi Ai dì, tổ chức hacker Lazarus Group đã chuyển 262,2 BTC đến địa chỉ mới cách đây 2 giờ, trị giá 16,64 triệu USD, hoặc có kế hoạch thực hiện rửa tiền.Hiện tại, tổ chức này vẫn nắm giữ tài sản trị giá hơn 73,06 triệu USD trên chuỗi, chủ yếu bao gồm BTC, USDT và ETH.

ChainCatcher tin tức, sàn giao dịch tiền điện tử Bybit đã đệ đơn kiện dân sự lên Tòa án Liên bang khu vực Washington D.C., kiện Bắc Triều Tiên, Tổng cục Tình báo Bắc Triều Tiên và tổ chức hacker Lazarus Group, vụ án liên quan đến sự kiện bị đánh cắp khoảng 1,5 tỷ USD vào tháng 2 năm 2025. Bybit cho biết, thẩm phán đã phê duyệt lệnh cấm tạm thời, cấm chuyển nhượng hoặc xử lý tài sản bị đánh cắp đã được xác định trong thời gian xét xử vụ án, và cho rằng khả năng Bybit thắng kiện về vấn đề thực thể là khá cao.Đơn kiện cũng liệt kê các cá nhân và thực thể không xác định nắm giữ hoặc chuyển nhượng các quỹ liên quan là bị cáo John Doe. Bybit tiết lộ, khoảng 48,4 triệu USD đã được thu hồi, khoảng 30,5 triệu USD đã bị đóng băng tại hơn 28 sàn giao dịch và tổ chức lưu ký, tổng cộng chiếm khoảng 5% số tiền bị đánh cắp. Kẻ tấn công đã chuyển khoảng 500.000 ETH từ ví lạnh của Bybit vào tháng 2 năm 2025, phần lớn số tiền sau đó đã được đổi thành Bitcoin qua Thorchain và chuyển đi qua dịch vụ trộn tiền. Bybit cho biết, vụ án đang tiến hành song song với cuộc điều tra hình sự.

Tin tức từ ChainCatcher, sàn giao dịch tiền điện tử Bybit đã đệ đơn kiện dân sự đối với Cộng hòa Dân chủ Nhân dân Triều Tiên, cơ quan tình báo của họ là Cục Tổng cục Tình báo (RGB) và tổ chức hacker Lazarus Group bị quốc gia trừng phạt, liên quan đến một vụ tấn công hacker trị giá 1,5 tỷ USD.Tòa án liên bang Hoa Kỳ đã ban hành lệnh cấm tạm thời, cấm việc chuyển nhượng hoặc tiêu hủy tài sản đã được xác định liên quan đến vụ án trong thời gian kiện tụng.

Tin tức từ ChainCatcher, theo dõi của Lookonchain, nhóm hacker Lazarus đã chuyển 121,5 BTC (774 triệu USD) cách đây một giờ.

Tin tức từ ChainCatcher, theo báo cáo của Bitcoin.com, Thượng nghị sĩ Mỹ Cynthia Lummis đang thúc đẩy dự luật CLARITY hoàn thành bỏ phiếu tại Thượng viện trước khi Quốc hội nghỉ. Điều khoản 303 của dự luật trao quyền cho Bộ Tài chính thực hiện các biện pháp trừng phạt đặc biệt đối với tài sản kỹ thuật số tại các khu vực tài phán nước ngoài, điều khoản 305 cho phép các sàn giao dịch thực hiện việc đóng băng tối đa 180 ngày đối với các giao dịch nghi ngờ.Dữ liệu trên chuỗi cho thấy, nhóm Lazarus của Bắc Triều Tiên đã đánh cắp khoảng 643 triệu USD trong nửa đầu năm 2026, chiếm hai phần ba tổng số tiền bị đánh cắp trên toàn cầu trong cùng thời gian (972 triệu USD), trong đó bao gồm cuộc tấn công 285 triệu USD vào Drift Protocol vào tháng 4 và cuộc tấn công 292 triệu USD vào cầu nối KelpDAO. Tổ chức này đã tích lũy tổng số tiền đánh cắp lên tới 6.75 tỷ USD kể từ năm 2019.Hiện tại, Galaxy Research đã hạ thấp xác suất thông qua dự luật CLARITY trong năm 2026 xuống còn 30%, dự luật này cần có 60 phiếu để tiến hành, có nghĩa là ít nhất cần 7 thượng nghị sĩ đảng Dân chủ bỏ phiếu ủng hộ qua đảng.

According to Cryptopolitan, cybersecurity analysts have discovered a new type of fileless remote access trojan (RAT) named RemotePE. It is believed that the cybercrime organization Lazarus Group, associated with North Korea, is using this trojan to attack banks and cryptocurrency companies. The trojan operates entirely in memory, making it difficult for traditional antivirus and forensic tools to detect. Attackers impersonate trading company employees via Telegram, using forged Calendly and Picktime links for social engineering attacks. The malware is loaded in a three-stage chain through DPAPILoader, RemotePELoader, and RemotePE, with the entire process avoiding contact with the file system, utilizing process hollowing, anti-analysis checks, and encrypted C2 communication to evade detection.This malware was first discovered in September 2025. In the first four months of 2026, the Lazarus organization has stolen approximately $577 million in cryptocurrency assets, accounting for 76% of the total global cryptocurrency theft. Since 2017, the organization has accumulated a total theft amount of $6 billion.

According to research by OpenSourceMalware, the North Korean hacker group Lazarus has adopted new techniques in malicious activities targeting developers, such as "infectious interviews" and "TaskJacker," hiding the second-stage loader in the pre-commit scripts of Git Hooks. "Infectious interviews" is a series of attack activities where the organization lures developers into cloning malicious code repositories by faking recruitment processes in the cryptocurrency/DeFi field, ultimately stealing crypto assets and credentials.Researchers recommend that developers who are asked to clone code repositories as part of the interview process should be wary of such risks and preferably run in an isolated environment to avoid mounting personal browser configurations, SSH keys, and cryptocurrency wallets.

According to CoinDesk, monitoring by CertiK reveals that the Lazarus Group is conducting an attack operation named Mach-O Man targeting executives in the fintech and cryptocurrency industries. This operation utilizes ClickFix social engineering techniques, sending fake online meeting invitations to lure victims into pasting repair commands on their Mac terminals, thereby gaining access to company and financial systems.CertiK researcher Natalie Newson stated that the Lazarus Group has stolen over $500 million through attacks on Drift and KelpDAO in the past two weeks. Mach-O Man is a modular macOS malware toolkit developed by the Chollima division of the Lazarus Group, capable of automatically deleting itself after use to evade detection.Additionally, attackers have implemented this attack by hijacking DeFi project domain names and replacing them with fake Cloudflare messages.

The report "2025 Cyber Threat Trends and 2026 Security Outlook" released by AhnLab shows that the North Korean-backed hacker group Lazarus has been named the most frequently in the past 12 months, primarily using "spear phishing" to carry out attacks, often disguising themselves as seminar invitations, interview requests, and other emails to lure targets into opening attachments. The report states that Lazarus is considered the main suspect in several major attacks, including the Bybit hacking incident on February 21 this year (resulting in a loss of $1.4 billion) and the recent $30 million vulnerability attack on the South Korean exchange Upbit.AhnLab indicates that to enhance security, companies need to establish a multi-layered defense system, including regular security audits, timely patch updates, and strengthening employee education. The company also recommends that individual users employ multi-factor authentication, handle unknown links and attachments with caution, avoid excessive exposure of personal information, and only download content from official channels. AhnLab points out that with the widespread use of AI applications, attackers will find it easier to generate indistinguishable phishing emails, spoofed pages, and deepfake content, and related threats may further complicate in the future. (Cointelegraph)

Regarding Upbit's incident of approximately 44.5 billion KRW (about 36 million USD) in cryptocurrency being stolen, CryptoQuant CEO Ki Young Ju stated today that the attack method disclosed by Upbit is "almost impossible for an ordinary hacker to accomplish."Upbit previously mentioned that the attackers might have "inferred the private keys" by analyzing the patterns of user wallet addresses. Ki Young Ju bluntly remarked that the difficulty of such attack techniques is extremely high, and if this is true, "I suspect that no hacker organization other than North Korea's Lazarus could achieve this."

CryptoQuant CEO Ki Young Ju commented on the "Upbit hacking incident," stating that the culprit is likely the North Korean hacking group Lazarus Group. Upbit announced that it discovered a security vulnerability that allowed private keys to be inferred. "If true, I suspect that no one else besides North Korean hackers could accomplish this."

According to Yonhap News Agency, South Korean virtual asset exchange Upbit has suffered a hacker attack, resulting in the theft of virtual assets worth 44.5 billion won. Currently, the North Korean reconnaissance agency's hacker organization Lazarus Group is highly suspected to be behind this incident.Local time, Yonhap News Agency learned from the information and communication technology (ICT) industry and relevant South Korean government departments that, given the significant suspicion surrounding the hacker organization Lazarus Group under the North Korean reconnaissance agency, authorities are conducting on-site inspections of Upbit. This hacker organization was previously implicated in the theft of 58 billion won worth of Ethereum from Upbit in 2019. A government official stated, "This attack is unlikely to have targeted the server; it is more probable that the administrator account was stolen, or that the attacker disguised themselves as an administrator to transfer funds." He also mentioned, "Based on the information currently available, the hackers used this method six years ago, so it is speculated that the same method was employed this time."

ChainCatcher news, EurekaTrading founder Kuan Sun tweeted a review of how he nearly lost $13 million due to a phishing attack: On September 2, 2025, approximately $13 million in assets in his wallet were almost stolen by the Lazarus hacker group. The security team acted urgently and ultimately recovered the funds.The incident was triggered by what appeared to be a normal Zoom meeting invitation, which was actually a carefully arranged phishing trap. The hackers exploited "acquaintance" relationships, deepfake videos, and a forged Rabby plugin to tailor the attack against the victim, Venus. Under the mistaken belief in the fake plugin, the victim executed a withdraw, putting the assets at risk of being transferred along with liabilities. PeckShield, SlowMist, Venus, and multiple security teams responded quickly, pausing the protocol and investigating risks, ultimately preventing the theft of funds. Hardware wallets are not foolproof; there are still risks of plugin and frontend hijacking; Zoom links, upgrade pop-ups, and acquaintance relationships can all serve as entry points for attacks.

ChainCatcher news, according to The Telegraph, the UK-registered cryptocurrency platform Lykke has been forced to cease operations and liquidate in March this year after being hacked and losing approximately £17 million (about $22.8 million) in Bitcoin and Ethereum. The UK Treasury's OFSI reported that the hackers are from North Korea's Lazarus group, and the funds were used for military and nuclear projects. Lykke founder Richard Olsen has been declared bankrupt, and the case is still under investigation.

ChainCatcher message, according to on-chain detective ZachXBT's monitoring, a user is suspected to have been attacked by the North Korean hacker group Lazarus Group on May 16, resulting in a loss of approximately 3.2 million dollars in assets. The stolen assets were sold on the market, and the stolen funds were subsequently cross-chained from Solana to Ethereum. On June 25, 400 ETH was deposited into Tornado Cash; on June 27, 400 ETH was deposited into Tornado Cash.

ChainCatcher message, the latest intelligence from the SlowMist security team indicates that the North Korean Lazarus hacker group is using a new type of espionage Trojan called OtterCookie to launch targeted attacks against cryptocurrency and financial professionals.The total methods include faking high-paying job interviews/investor meetings, using deepfake videos to impersonate recruiters, and disguising malware as "programming test questions" or "system update packages."The targets for theft include login credentials saved in browsers, passwords and digital certificates in the macOS Keychain, as well as cryptocurrency wallet information and private keys.SlowMist recommends being vigilant about unsolicited job/investment offers, requiring multi-factor authentication for remote interviews, avoiding running executable files from unknown sources, especially so-called "technical test questions" or "update patches," strengthening endpoint protection (EDR), deploying antivirus software, and regularly checking for abnormal processes.

ChainCatcher news, according to Cointelegraph, BitMEX thwarted a cyber attack by the North Korean Lazarus Group hackers, who targeted its employees through fake NFT partnership offers on LinkedIn. BitMEX stated that the hackers' strategy was not complex.It is reported that the Lazarus Group contacted a BitMEX employee on LinkedIn, proposing an NFT partnership, with the real goal of tricking the employee into running malicious code from a GitHub repository. After reviewing the codebase, the employee flagged suspicious code, and BitMEX's security team quickly investigated, identifying obfuscated JavaScript and tracing it back to infrastructure associated with Lazarus.

ChainCatcher news, according to Finance Feeds, the North Korean hacker group Lazarus Group has recently shifted its attack targets to individual investors, stealing over $5.2 million from a merchant through malware on May 24. The stolen funds involve multiple wallet types, including exchange wallets, multi-signature wallets, and external accounts.Blockchain analyst ZackXBT tracked that the hackers have transferred about 1,000 ETH through the mixer Tornado Cash.Security experts recommend that individual investors take protective measures: use hardware wallets to store large assets, enable two-factor authentication, regularly update software patches, be wary of suspicious links, and regularly check transaction records. This attack marks a strategic shift for the organization from targeting institutions to individual investors.

ChainCatcher news, according to Cointelegraph, Manta Network co-founder Kenny Li revealed a highly sophisticated phishing attack. The attackers used video footage of real team members during a Zoom video call, attempting to lure him into downloading malware.Li stated that the other party's camera was on during the video call and the facial footage was real, but there was no sound. The system prompted him to update Zoom and download a script file, which raised his alert. He believes this attack may have been initiated by the North Korean state-sponsored hacker group Lazarus. After being asked to verify identity via Telegram, the attackers immediately deleted all messages and blocked him.