Lazarus Group moves 244 BTC worth 19.4 million USD as Bybit lawsuit advances

Lazarus Group, the North Korea-linked hacking operation blamed for some of the largest thefts in crypto history, has moved another tranche of Bitcoin, according to on-chain analytics account Lookonchain. The transfer involved 244.148 BTC valued at roughly 19.42 million USD at the time of the alert, and it lands just weeks after the group was sued in a United States federal court over the 1.5 billion USD Bybit hack.

Lookonchain flagged the movement in an August 28 post on X, describing wallets attributed to Lazarus Group as active again after a period of relative quiet. The analytics account said the coins moved about an hour before its alert went out. Bitcoin traded near 79,500 USD when Lookonchain published its estimate, which places the total value of the transfer at approximately 19.42 million USD.

Destination of the Bitcoin remains unknown

Notably, Lookonchain did not identify the receiving address, and it did not say whether the Bitcoin was sent to an exchange, a mixing service, or another wallet controlled by the group. That distinction matters. A wallet-to-wallet transfer does not by itself demonstrate that Lazarus sold the coins or attempted to cash out. Public blockchain records confirm when funds move between addresses, but attributing those addresses to an organization depends on labels and analysis supplied by investigators and blockchain intelligence firms.

The August 28 transaction followed another large movement attributed to the group earlier in the month. On August 12, Lookonchain reported that Lazarus-linked wallets transferred 262.2 BTC, then valued at approximately 16.64 million USD, from an identified address to a newly created one. That earlier transaction was also described as a wallet-to-wallet transfer rather than a sale. Taken together at their reported values, the two August movements involve more than 36 million USD in Bitcoin, although no source has confirmed that both transactions drew from the same balance or served the same purpose.

A history of incremental repositioning

Prior wallet activity shows why analysts watch these movements closely even when the destination is unclear. In March 2025, five unknown addresses received a combined 44.07 BTC worth about 3.76 million USD from wallets attributed to Lazarus, according to earlier on-chain reporting. Those transactions reduced the tracked wallet’s holdings to 13,441 BTC at the time, a figure that illustrates the sheer scale of the group’s accumulated stash.

The pattern is consistent with how the Federal Bureau of Investigation has described the group’s cash-out strategy. After the February 2025 Bybit attack, which the FBI attributed to North Korean actors operating under the TraderTraitor banner, the bureau warned that the attackers had converted part of the stolen holdings into Bitcoin and other assets before spreading them across thousands of addresses on several blockchains. The FBI said it expected the assets to be moved again and eventually exchanged for government-issued currency, and it asked exchanges, bridges, decentralized finance services, blockchain analytics companies, and node operators to block transactions involving the addresses it identified.

Bybit takes the fight to court

The latest transfer also comes as Bybit pursues an unusual legal route against the group itself. On August 7, the exchange sued North Korea and Lazarus Group in a Washington, D.C., federal court, seeking to recover assets tied to the 1.5 billion USD theft. The lawsuit also named North Korea’s Reconnaissance General Bureau, the intelligence agency identified by the United States Treasury as the country’s main intelligence organization.

A federal judge issued a preliminary injunction that blocked unidentified defendants from transferring, selling, or disposing of certain assets connected to the case. A preliminary injunction preserves identified property while litigation continues and does not amount to a final decision on ownership or liability. Bybit filed the civil action separately from ongoing United States criminal investigations into the hack.

Recovery efforts have had partial success. By April 2025, Bybit chief executive Ben Zhou said that 27.6 percent of the stolen funds could no longer be moved, a milestone reached through coordination with exchanges and blockchain analytics firms that froze or blocked portions of the loot as it passed through their systems.

Why wallet watching still matters

For market observers, the significance of a 19.42 million USD transfer is less about immediate price impact and more about what it signals regarding the group’s operational tempo. Large movements from tracked Lazarus wallets have historically preceded laundering attempts, in which stolen Bitcoin is cycled through mixers, cross-chain bridges, and smaller exchange accounts to obscure its origin before conversion into fiat currency.

United States sanctions generally prohibit Americans from dealing with property linked to the Lazarus Group, which means any exchange or service that knowingly processes these funds risks legal exposure. That legal framework is precisely why analysts publish real-time alerts when tracked wallets awaken: every hop between addresses is a window in which compliance teams can intervene, freeze deposits, or flag receiving accounts before the funds disappear into the broader financial system.

Neither Lookonchain nor any law enforcement agency has commented on whether the August 28 transfer is connected to the Bybit litigation or to the preliminary injunction issued in Washington. As of publication, the receiving wallet has not been publicly identified, and the 244.148 BTC remains unaccounted for in public reporting. The crypto industry will be watching the next movement from these addresses closely, because if history is any guide, this transfer is unlikely to be the last.