BitMEX’s security team has exposed significant operational weaknesses within the Lazarus Group, the North Korean state-sponsored cybercrime network responsible for a string of high-profile crypto hacks.
In a recent counter-operations probe, BitMEX researchers identified technical missteps that revealed parts of the group’s infrastructure.
Supabase is a platform that simplifies database deployment, and its use by Lazarus highlights the group’s evolving operational tools. It notes an “asymmetry” between low-skill social engineering teams, responsible for tricking users into downloading malware, and the more advanced developers creating sophisticated exploits.
One key finding suggests that a hacker likely exposed his real IP address during an operation, pinpointing a location in Jiaxing, China — a rare lapse for the highly secretive group.
Now, international concern is growing. A Bloomberg report suggests world leaders may address the Lazarus threat at the upcoming G7 Summit, exploring coordinated strategies to mitigate damage from the group’s activities.
In September 2024, the FBI warned about phishing scams using fake job offers to lure crypto users.
The findings come amid a wider surge in DPRK-linked cyber activity. Global law enforcement agencies continue to investigate the group’s operations.
The Lazarus Group, North Korea’s most infamous hacking collective, is believed to be behind a series of major crypto thefts, including a record $1.4 billion heist from exchange Bybit in February. Chainalysis has claimed that North Korean-linked actors stole over $1.3 billion across 47 separate incidents in 2024 alone. Beyond external hacks, the regime employs rogue IT workers to infiltrate crypto firms from within — a tactic flagged in a joint warning from the U.S., Japan, and South Korea.
G7 leaders are expected to address North Korea’s escalating cyberattacks and cryptocurrency thefts at next month’s summit in Canada.