North Korea-Linked Lazarus Deploys New Malware Against Financial and Crypto Institutions
Lazarus is regarded as a North Korea-linked hacking group that has long targeted banks, payment systems and cryptocurrency companies to steal funds through cyber intrusions. Financial and digital-asset institutions hold large amounts of high-value assets, leaving them vulnerable to theft and operational disruption if security systems fail to detect an attack.
Cybersecurity firm Fox-IT recently said Lazarus had switched to the newly developed RemotePE malware toolkit. The malware uses in-memory execution and multiple evasion techniques to bypass security tools while establishing remote-access capabilities. However, available information does not specify the report’s publication date, the names of the targeted institutions, the number of victims or the amount of losses.
All Coverage
1 original reportsThe Backstory
The history behind this eventNorth Korean Hackers Infiltrate Crypto Firms as IT Workers, Steal More Than $2 Billion in 2025
North Korean hackers have long used false identities to apply for remote IT jobs, gaining access to private keys, core code and internal systems after infiltrating blockchain and AI companies. Such attacks not only lead to cryptoasset theft but also increase the risks facing multinational companies in employee screening and supply-chain security.
A Chainalysis report found that North Korean hackers stole about $2.02 billion in cryptoassets in 2025, up 51% year on year and accounting for roughly 60% of the global total stolen. CertiK put the figure at $2.06 billion. In a recent case, an interviewer exposed a North Korean operative posing as a Japanese engineer by asking the applicant to criticize Kim Jong Un.
North Korean Hackers Account for 76% of Crypto Stolen in 2026
North Korea-linked hacking groups have long targeted cryptocurrency platforms, with organizations such as Lazarus particularly adept at attacking DeFi protocols. Because stolen assets can be moved rapidly across borders, such attacks not only threaten investors and protocol security but also renew concerns about North Korea obtaining funds through digital assets.
A TRM Labs report found that North Korea-linked hackers accounted for 76% of total cryptocurrency thefts in 2026. In April, hackers stole about $577 million from DeFi protocols including Drift Protocol and Kelp DAO over 18 days. Global crypto hack losses exceeded $630 million that month, the highest since February 2025.
Subscribe to Mark Radar Weekly
Every Friday, the week's strongest signals in your inbox. Unsubscribe anytime.
If you search news on Google, you can set Mark Radar as a preferred source—our coverage will show up more often in your results. Set as preferred source on Google →