North Korea's

A $1.5 billion Bybit theft attributed to Lazarus in February 2025 crystallized coverage of North Korea as a cyber-enabled crypto-theft and sanctions-evasion threat.

Who they are

In this coverage, North Korea appears principally as the state linked to cyber operations, rather than as a consumer-technology market: Lazarus Group and other DPRK-affiliated actors are tied to cryptocurrency theft, laundering, and fraudulent remote IT employment, while earlier stories also covered the country’s controlled internet and Red Star OS.

The recent arc

The all-time coverage high came in 2020Q1, when U.S. sanctions targeted two Chinese nationals accused of laundering cryptocurrency for Lazarus. Reporting later broadened beyond hacks: Microsoft’s 2020 account of North Korean and Russian APTs targeting COVID-19 vaccine companies, and the 2023 Treasury action over an overseas “army” of illicit IT workers, framed DPRK activity as a wider cyber and revenue-generation apparatus.

The recent arc

The most consequential recent turn is the 2025Q1 Bybit episode. Arkham said ZachXBT’s evidence linked Lazarus to the $1.5 billion theft, described as crypto’s largest single theft, while 2024 reporting traced Lazarus funds to Cambodia’s Huione Pay and U.S. policy coverage emphasized disrupting laundering that Washington says supports weapons programs. The latest stories extend that focus to fake tech workers: Google described DPRK workers obtaining remote jobs in Europe, and OFAC sanctioned people and companies connected to the scheme in July 2025.

The tension

Coverage centers on an enforcement-versus-adaptation contest. The U.S., Binance, Huobi, and crypto investigators seek to freeze assets, impose sanctions, and expose infrastructure, while Lazarus and North Korea-linked workers are portrayed as moving through exchanges, cross-border laundering channels, and remote-employment systems; China and Russia recur as locations associated with laundering or worker operations.

Why it matters

If this trajectory holds, North Korea’s technology story will increasingly be about the overlap of cybercrime, financial infrastructure, and labor-platform abuse, not isolated intrusions. The scale alleged in the Bybit case raises the stakes for exchanges and investigators, but the corpus also suggests that pressure on one channel may shift attention toward laundering networks and covert employment, making attribution and enforcement persistently difficult.

Related: Lazarus Group · Bybit · U.S. · Russia · Arkham says ZachXBT submitted proof that North Korea's Lazarus Group i