The North Korean-linked Lazarus Group has moved 121.5 Bitcoin (BTC) worth approximately $7.74 million to new wallet addresses, according to blockchain intelligence platform Arkham, in the latest sign that the hacking group remains active in moving stolen crypto.
Arkham flagged the transaction on July 30, showing the funds leaving a wallet previously linked to Lazarus and arriving at fresh, unidentified Bitcoin addresses. The transfer was detected about an hour after it occurred and quickly drew attention across the crypto community.
The Lazarus Group hackers moved 121.5 $BTC ($7.74M) an hour ago.https://t.co/kpMHWnl7iQ pic.twitter.com/5qrmlvxMGd
— Lookonchain (@lookonchain) July 30, 2026
The movement adds to a long-running pattern of fund transfers tied to the group. Arkham has tracked 625 transactions connected to Lazarus-linked wallets, highlighting the group’s continued efforts to gradually move and conceal illicit assets instead of making large, immediate transfers.
Lazarus Group moves the Bitcoin to a new address
The latest transfer does not appear to involve a direct deposit to a cryptocurrency exchange. Instead, the Bitcoin was sent to a newly created bc1q address, a method commonly associated with layering funds to make them harder to trace.
Blockchain analysts say Lazarus has repeatedly relied on fresh wallet addresses, mixers, cross-chain bridges and over-the-counter trading channels to obscure the origin of stolen assets before attempting to cash them out.
On-chain analyst Alex Bayarchyk noted that Lazarus wallets rarely remain inactive for long, pointing to the latest transaction as another example of the group’s steady laundering strategy rather than a sudden attempt to sell its holdings.
The Lazarus Group, also known as Hidden Cobra, has remained one of the biggest cyber threats facing the cryptocurrency industry. The state-backed hacking organization is accused of stealing digital assets to help North Korea bypass international sanctions and fund government programs.
North Korean hackers had stolen an estimated $577 million in cryptocurrency by April 2026. Most of those losses came from two attacks: the $285 million exploit of Drift Protocol on April 1 and the $292 million attack on the KelpDAO bridge on April 18. Together, the incidents accounted for roughly 76% of crypto losses reported during that period.
Could the CLARITY Act curb crypto laundering?
The latest Lazarus transfer comes as US lawmakers continue to debate the CLARITY Act. The bill will strengthen oversight of digital assets and make it harder for criminals to move stolen cryptocurrency. Whether the CLARITY Act can curb money laundering is still heavily debated, with lawmakers arguing that it could protect crypto through established frameworks.
The legislation would expand anti-money laundering requirements to crypto exchanges, DeFi platforms and crypto ATMs, while giving the US Treasury greater authority to restrict transactions linked to high-risk foreign jurisdictions. It would also allow exchanges to freeze suspicious transactions for up to 180 days if they are working with law enforcement, increasing the chances of recovering stolen funds before they are laundered.
While the House has approved the bill and the Senate Banking Committee has advanced a compromise version, disagreements over sanctions, anonymity and ethics rules for public officials have delayed a final Senate vote, leaving the legislation awaiting further action.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
