As Crypto Regulations Lag, DPRK Steals $21M with Sophisticated Laundering Schemes

North Korean state-sponsored hackers affiliated with the Lazarus Group have been implicated in a $21 million cryptocurrency theft from SBI Crypto, a mining pool subsidiary of Japan's SBI Group. Blockchain investigators, including ZachXBT, traced the breach to suspicious outflows from SBI-linked addresses on September 24, 2025, involving Bitcoin, Ethereum, Litecoin, Dogecoin, and Bitcoin Cash. The stolen funds were routed through five instant exchanges before being laundered via Tornado Cash, a crypto mixer previously sanctioned by the U.S. Treasury for facilitating illicit transactionsCryptonews.com^[1]. The tactics mirrored those used in prior North Korea-linked heists, including rapid fund movement and decentralized laundering toolsCoinDesk^[2].

The incident underscores the growing sophistication of DPRK cyber operations, which have collectively stolen over $2.2 billion in 2025 alone. Lazarus Group's activities extend beyond direct thefts to include infiltration of crypto infrastructure through fraudulent employment schemes. In June 2025, the group exploited a fake developer ring to breach the Favrr project, netting $680,000CoinTelegraph.com^[3]. These campaigns often involve AI-generated identities, malware-infected coding tests, and shell companies to evade detectionTheCurrencyAnalytics.com^[4]. The U.S. Department of Justice recently seized $7.7 million in cryptocurrency linked to such schemes, highlighting the scale of DPRK operationsPicusSecurity.com^[5].

The use of Tornado Cash in the SBI Crypto heist has reignited debates over regulatory efficacy. While the U.S. Treasury removed sanctions on the mixer in March 2025, citing legal challenges to its designation as "property" under sanctions law, the platform remains a critical tool for laundering stolen assetsTheHackerNews.com^[6]. North Korean hackers have historically leveraged Tornado Cash to obscure the trail of multi-billion-dollar thefts, including the $1.5 billion Bybit exploit in February 2025TheBlock.co^[7].

SBI Group, which has not publicly confirmed the breach, operates as a major player in Japan's financial sector, with significant exposure to crypto assets. The attack highlights vulnerabilities in mining pools and exchanges, which are increasingly targeted due to their high-value holdings. Cybersecurity experts warn that North Korean groups are shifting toward more covert methods, such as social engineering and malware-laden job interviews, to bypass traditional security measuresHuntress Blog^[8].

Global law enforcement agencies continue to combat DPRK-linked cybercrime. The FBI has dismantled fake U.S.-registered companies like Blocknovas LLC and Softglide LLC, used by Lazarus to distribute malwareReuters^[9]. However, the group's adaptability-evidenced by the use of AI-generated personas and advanced phishing techniques-poses persistent challenges. As of press time, the stolen $21 million remains unaccounted for, with SBI Crypto yet to issue an official statementDecrypt.co^[10].