Lazarus Hacker Group Starts Moving Bitcoin: Analyzing the Pattern

Thu, 13/08/2026 - 8:00
Lazarus Group is active again, restructuring their Bitcoin holdings in an unexpected manner.
Advertisement
Lazarus Hacker Group Starts Moving Bitcoin: Analyzing the Pattern
Cover image via depositphotos.com

Disclaimer: The opinions expressed by our writers are their own and do not represent the views of InkByte. The financial and market information provided on InkByte is intended for informational purposes only. InkByte is not liable for any financial losses incurred while trading cryptocurrencies. Conduct your own research by contacting financial experts before making any investment decisions. We believe that all content is accurate as of the date of publication, but certain offers mentioned may no longer be available.

Google
Advertisement

Suddenly, 262.2 BTC, or roughly $16.6 million at current prices, was transferred from a Bitcoin address identified as belonging to the North Korea-affiliated Lazarus Group. Although the structure of the transaction does not yet appear to be a simple liquidation of the group's Bitcoin holdings, it still merits attention.

Restructuring their holdings

The transaction shows 262.20040151 BTC leaving bc1q62cl...ddkteq and being divided between two new addresses. Approximately 182.2 BTC went to bc1qwnah...ld5g2xy5, while exactly 80 BTC was transferred to bc1qxdkk...0874k9zs.

Article image
BTC/USDT Chart by TradingView

Since the provided transaction data does not show an exchange destination, the transfer itself cannot be interpreted as proof that Lazarus is selling $16.6 million worth of Bitcoin. Rather, the movement is similar to the first phases of fund redistribution: transferring holdings between new addresses before further transactions decide where they will ultimately end up. 

HOT Stories
XRP, Zcash (ZEC), Dogecoin (DOGE) and Bitcoin (BTC) Price Analysis for August 13: It Becomes Clearer Former Ripple Partner Deepens Solana Ties

This behavior is in line with the more general issue that investigators encounter when tracking cryptocurrencies connected to Lazarus. According to court documents, Lazarus/APT38 and other North Korean hacking groups run networks of wallets that are used to transfer money obtained from cyberattacks. 

Advertisement

Could it be a simple washing?

According to research, Lazarus-linked Bitcoin addresses are not just wallets that instantly send money to exchanges, but rather parts of larger money laundering networks. However, there is little immediate significance for the price of Bitcoin. The current price of Bitcoin is around $63,800, so a movement of 262 BTC is equivalent to about $16.7 million. 

In comparison to the typical market liquidity of Bitcoin, even if the whole amount were eventually sold, that would still be quite little. There is also no clear response to the transfer on the price chart. With a short-term average of about $64,000 and a 50-day moving average of about $63,400, Bitcoin is still concentrated between $63,000 and $65,000. 

About $66,600 and $71,900 are still the higher resistance levels. As a result, this transaction is much less important than the ones that follow. The movement would appear more and more like a liquidation or money laundering sequence if the two receiving wallets started splitting the Bitcoin further, interacting with more intermediary addresses, or eventually depositing funds into exchanges.

Advertisement

Although the blockchain evidence does not yet indicate that Lazarus is selling its Bitcoin, it currently appears to be moving its Bitcoin.

Advertisement
Advertisement
Advertisement
Advertisement
Subscribe to daily newsletter

Recommended articles

Our social media
There's a lot to see there, too
Advertisement