Summary preview
The Ghost Army of North Korea: Lazarus, Stealing Billions
Imagine a country where 25 million people have never seen the internet. Sounds like a sci-fi movie plot, right? But that's the reality. And in this very country, around 8,000 hackers are at work. They don't know what YouTube is, they've never opened Google, yet over the past 10 years, they've managed to steal over 7 billion dollars. That's an amount exceeding the GDP of some nations. And every stolen cent, in essence, turns into a nuclear warhead. My name is Mr. Darkweb, and today I'm going to tell you about Lazarus – a real hacker army that might be inside your wallet right now.
The Beginning: A Chance Find and an Alarming Sign
This story started for me completely by chance at the end of 2024. I was digging through leaks from a major dark web forum, gathering intel on financial schemes in Southeast Asia. Routine, nothing special. But among dozens of files, I stumbled upon one I initially paid no attention to. It was a small text document, written in broken English, without a title or signature. Inside was a list of wallets, dates, transfer amounts, and at the very end, a note that roughly translates to: "Never touch these addresses. These are not people, this is the state." At the time, I didn't get it. I thought it was someone's paranoia or a joke. I saved the file and forgot about it. But two months later, in February 2025, an event occurred that made that phrase stop seeming like a joke. 155 billion dollars vanished overnight from the world's largest crypto exchange. No password hacks, no phishing, not a single mistake from the victim's side. And when the FBI named the culprits – the Lazarus Group – I remembered that document. I opened it, compared the addresses with those published by the Bureau. Four out of fifty-one matched. From that moment, I started digging, and the deeper I went, the scarier the picture became. Lazarus isn't just a hacker group in the usual sense. It's not a bunch of basement-dwelling hoodie enthusiasts or anonymous chat users looking to make a quick buck. It's the cyber army of an entire nation – North Korea. The most closed-off country on the planet, which officially denies their existence but, at the same time, builds its entire missile program on their work. The US Department of Justice calls Lazarus an instrument for undermining global cybersecurity and generating illicit revenue in violation of international sanctions. Behind this dry wording lies a reality that is unsettling. Lazarus is behind the attack on Sony Pictures in 2014, the heist of the Bangladesh Bank in 2016, the WannaCry virus that paralyzed hospitals in 150 countries in 2017, and dozens of crypto heists totaling over 7 billion dollars. I spent several months on this investigation, poring over hundreds of documents: indictments from the Justice Department, FBI reports, analytics from blockchain companies Chainalysis and Elliptic, testimonies from North Korean defectors, materials from UN expert panels, and private threads on dark web forums. And the more I read, the clearer it became: what Lazarus does is unprecedented. There has been nothing like it in history. No country in the world has ever built its economy on hacking attacks. But North Korea has. This is a story about state-sponsored terrorism disguised as cybercrime. About a country that turned its best mathematicians into thieves. About people who are selected in school, trained like special forces, sent abroad, and who steal billions without being allowed to keep a single penny for themselves. And I won't start from the beginning, but from the end – with the biggest heist in cryptocurrency history. Because it's
The Biggest Heist in Crypto History: The BYBIT Hack
February 21, 2025, Friday. Dubai. The office of BYBIT – one of the world's largest cryptocurrency exchanges. A normal workday. Routine operation: transferring funds from a cold wallet to a hot wallet. A procedure employees had performed dozens of times. Three signatures out of several confirmations. Everything according to protocol. On the screen – the standard interface of Safe Wallet, a multi-signature platform used by thousands of companies worldwide. The amount, recipient address, confirmation button. CEO Ben Zhou looked at the screen. Everything looked perfect. He clicked "Confirm." Two other employees did the same. Forty minutes later, 401,347 units of Ethereum, nearly 1.5 billion dollars, disappeared. Not to the wrong address, not to the wrong wallet, not to the wrong country. It's important to understand: no one made a mistake. The system didn't fail. Passwords weren't stolen. Employees didn't click on a phishing link. They did exactly what they were supposed to do. And that's precisely what those on the other side of the screen were counting on. What actually happened? A few days before the attack, hackers compromised the computer of one of Safe Wallet's developers – not BYBIT's, but the platform's itself, through which the confirmation was being processed. They didn't break through defenses head-on, didn't brute-force passwords, didn't look for code vulnerabilities. They infiltrated through a person. Social engineering: a call, an email, an invitation to a conference, or a fake interview. The exact method is still classified, but according to the Safe Ecosystem Foundation, the compromise occurred via the developer's workstation. Having gained access to his machine, the hackers stole session tokens – temporary keys that allow logging into the company's cloud service without re-entering a password. This is how they bypassed two-factor authentication. They calculated the timing, working during the same hours as the developer to avoid raising suspicion from monitoring systems. And then, on February 19th, two days before the attack, they replaced a single file – a fragment of JavaScript code responsible for displaying transactions. This file made its way to the server through the official Safe Wallet domain. It worked perfectly for all users, except one. Except BYBIT. How could 1.5 billion disappear and no one notice at the moment of transfer? Sounds like a bad script, but that's exactly how it works. When you're used to clicking "Confirm" every day, and everything always goes smoothly, you don't re-check every pixel on the screen. It's not negligence; it's trust in a system used by thousands of companies. And Lazarus didn't hack the system; they hacked that trust. The tampered code showed BYBIT employees one thing, but sent something else entirely. Their signatures on hardware wallets turned into what security specialists later called "blind signing." They confirmed a transaction they couldn't see. Ten hours after the hack, 350,000 BYBIT
Funding the Missile Program: Money from Cyberspace
According to estimates from a UN expert panel disbanded in 2024, up to 40% of North Korea's nuclear and missile program funding comes from cyber heists. 40% – not from coal trade, not from arms sales, not from allies' aid, but from stolen cryptocurrency. This isn't a journalistic hypothesis; it's the conclusion of an international commission operating under a Security Council mandate. The 1.5 billion stolen from BYBIT is not a crime for profit. It's a line item in a state budget that officially doesn't exist. In 2025 alone, according to the analytical platform Chainalysis, hackers linked to North Korea stole over $2 billion, a 51% increase from the previous year. Cumulatively from 2019 to the end of 2025 – $6.75 billion. That's 76% of all cryptocurrency thefts worldwide. Three-quarters – one country, one operator. The analytical company Elliptic, which investigated the hack, formulated it this way: "The Lazarus Group is not a state-sponsored group in the traditional sense. Lazarus is North Korea, and North Korea is Lazarus. There is no boundary between the hackers and the regime, no gap. It's a single organism." And this is where the darkest part of this story begins. Because to understand how a group from one of the poorest and most isolated countries in the world learned to steal billions, we need to go back 20 years, to a place almost no one knows about. To where children are selected in school. Not for athletic achievements, not for musical talent, but for their ability to solve math problems faster than anyone else. And where these children are turned into soldiers who will never pick up a weapon but will inflict more damage than any army.
Birth of a Cyber Army: From Kim Il-sung to Bureau 121
In 1996, Kim Jong-il, then the acting leader of North Korea, visited military personnel on the front lines. According to testimonies preserved in South Korean intelligence reports, he uttered a phrase that defined the next 30 years of his country's history: "All future wars will be computer wars." 1996. The internet barely existed. Most people on the planet didn't know what email was, yet the man ruling one of the world's poorest countries had already realized that a keyboard was more dangerous than a tank. Later, in the 2000s, he expressed himself even more forcefully. According to researchers from C4ADS, citing South Korean intelligence materials, Kim Jong-il stated that cyberattacks are like atomic bombs. "The war is won by whoever gains more access to the enemy's military-technical information during peacetime." He wasn't joking; he was building an army. In 1998, Bureau 121 was established – a cyber warfare unit within the General Reconnaissance Bureau (RGB). This isn't an analog to some IT department. It's a full-fledged military structure subordinate to the Third Technical Surveillance Bureau – the main body responsible for all of North Korea's cyber operations. Early estimates placed the number of specialists in Bureau 121 at around 1,800. By 2014, the South Korean NIS agency increased this figure to 5,900. Now, according to The Wall Street Journal, we're talking about 8,000 full-time hackers organized into military units. But where do hackers come from in a country without internet? The answer is simple and terrifying. They are raised from childhood. Across North Korea, a selection system established in the 1990s is in place. In middle and high schools for gifted students, computers are installed. According to defectors, until recently, these were machines at the Pentium 4 level. Teachers identify children with outstanding mathematical abilities. The best are sent to specialized universities. The main one is Mirim University, also known as Pyongyang University of Automation. It graduates about 100 hackers annually. Jang Se-yul, a defector who studied at Mirim and later fled to South Korea, described the educational process: six classes of 90 minutes each day. Programming languages from C to Assembly, operating systems Linux and Windows. A huge amount of time was spent dissecting Microsoft Windows architecture: how it works, where its vulnerabilities lie, how to infiltrate it. Five years of training, no weekends in the usual sense, no free internet, just study and practice. Alongside Mirim, Kim Il-sung University, Kim Chaek University of Technology, and Moranbong University operate. The most capable students are sent there. Kim Hyung-kwang, a former computer science professor who taught in Hamhung universities for 19 years, preparing future cyber warriors, stated after defecting to South Korea that his best students went for internships in China, particularly in the city of Shenyang, where a front company called Chosen Expo Joint Venture
The Sony Pictures Attack: Revenge for a Comedy
The morning of November 24, 2014, is forever etched in the memory of Sony Pictures Entertainment employees. People came to work and found their computers dead. On their screens – an image of a red skeleton and a message from a group calling itself Guardians of Peace. The text was simple: "We have taken everything. If you do not comply with our demands, we will publish it." It wasn't an exaggeration. Hackers were inside the Sony network for at least 2 months, some reports say up to a year. During this time, they copied over 100 TB of data: internal executive emails, financial documents, personal employee data (social security numbers, medical records, salaries), unreleased films, scripts for future projects. Then they activated a malicious program that destroyed about 70% of the company's server infrastructure. Hard drives were overwritten, boot records erased, computers turned into "bricks." The reason: a comedy. The film "The Interview" starring Seth Rogen and James Franco. A satire in which two journalists are recruited by the CIA to assassinate Kim Jong-un. A film that few would likely remember six months later if not for Lazarus. "Guardians of Peace" demanded that Sony cancel the premiere, and then began threatening terrorist attacks at cinemas that would show the film. Major American chains refused to screen it. Sony initially canceled the premiere, then, under public pressure, eventually released the film in limited theatrical release and online. On December 19, 2014, the FBI officially stated: "North Korea is behind the attack." President Obama made a public statement, calling the hack "not an act of war, but a serious attack on national security." The United States imposed additional sanctions. And as I studied this case, I thought about this: a state attacked a private company over a comedy. Not over intelligence, not over military secrets, but over a joke. And it caused damage that Sony estimated at $15 million in the first quarter alone, not counting reputational losses and lawsuits from employees whose data was leaked. But the most telling thing is that Lazarus used this hack as training: they tested methods, checked infrastructure, studied the reaction. Because the next target was of a completely different caliber. Not an entertainment company, but a Central Bank.