North Korean Lazarus group linked to 31 cyberattacks, suspected in $30.6M Upbit breach

A North Korean hacking group known as Lazarus has emerged as the most prolific advanced persistent threat actor tracked over the past year, according to a security assessment released Sunday by AhnLab Inc., a Seoul-based software security firm. Between October 2024 and September 2025, the group was linked to at least 31 separate cyberattacks—a volume that places it at the top of the rankings for organized state-sponsored hacking operations. A second North Korean-backed group, Kimsuky, followed with 27 confirmed incidents during the same period, underscoring the sustained pressure these adversaries are placing on targets across the region and beyond.

The timing of the report carries particular weight because Lazarus is now the prime suspect in a major cryptocurrency heist that struck South Korea's largest digital asset exchange just days earlier. Last week, Upbit—the platform operated by Dunamu—confirmed that unauthorized actors had transferred approximately 44.5 billion won in Solana-affiliated assets, equivalent to roughly $30.6 million, to wallets outside the company's control. Dunamu announced it would absorb the full loss using its own reserves, a commitment that underscores both the severity of the breach and the exchange's attempt to stabilize confidence among its users.

What makes the Upbit incident particularly significant is not merely its scale but the apparent continuity of method. South Korean authorities noted that the techniques deployed in this latest attack bear striking similarities to a 2019 breach in which Lazarus allegedly stole 58 billion won worth of Ethereum from the same exchange. The parallel suggests either a consistent operational playbook or, more troublingly, that the group has successfully evaded detection and remediation for years while refining the same approach. The resemblance has prompted investigators to treat the recent incident as part of a longer pattern rather than an isolated event.

AhnLab's assessment carries an important caveat: the 31 incidents attributed to Lazarus likely represent only a fraction of the group's actual activity. Advanced persistent threat groups employ sophisticated techniques specifically designed to avoid detection—dormant code, encrypted communications, compromised infrastructure that masks their true origin. Many attacks go unreported or undetected entirely, meaning the true scope of Lazarus's operations could be substantially higher than any public accounting suggests. The firm's willingness to acknowledge this gap reflects the reality that cybersecurity visibility remains incomplete, even among the most capable defenders.

The investigation into the Upbit breach is already underway. South Korean authorities have indicated they plan to conduct an on-site investigation at the exchange, working from the assumption that Lazarus bears responsibility. The investigation will likely focus on how the attackers gained initial access, what persistence mechanisms they established, and how long they may have maintained presence within Upbit's systems before executing the theft. Each of these questions carries implications not just for Upbit but for the broader cryptocurrency sector in South Korea, where exchanges have become increasingly attractive targets for state-sponsored actors seeking to acquire hard currency and digital assets.

Lazarus has long been associated with North Korea's broader cyber operations strategy. The group has been linked to some of the most consequential cyberattacks of the past decade, including the 2014 breach of Sony Pictures and the 2016 theft of $81 million from the Bangladesh central bank. What distinguishes the group from purely criminal hacking operations is its apparent alignment with state interests—attacks that serve both financial and intelligence-gathering objectives. The Upbit breach, if confirmed as Lazarus's work, fits this pattern: it generates immediate financial gain while simultaneously testing the defenses of critical financial infrastructure.

For South Korea, the findings underscore a persistent vulnerability. The country hosts some of the world's largest cryptocurrency exchanges and maintains significant digital infrastructure, making it an attractive target for adversaries seeking both economic gain and strategic advantage. The fact that Lazarus has been able to conduct at least 31 separate operations over a single year, with one resulting in a theft of tens of millions of dollars, suggests that current defensive measures—while sophisticated—remain insufficient against determined, well-resourced state actors. The coming weeks will reveal whether the on-site investigation produces evidence that definitively links Lazarus to the Upbit incident, and whether that evidence yields any insights into how the group might be disrupted or deterred.