# Lazarus Group North Korean state-sponsored hacking organization, designated by the U.S. Treasury and treated by OFAC as an arm of DPRK revenue generation rather than an independent criminal enterprise. Treasury has estimated the group stole **over $2 billion** in digital assets across multiple operations. Lazarus is the reason [[Tornado Cash]] was sanctioned. Treasury's August 2022 designation rested on the group's use of the mixer to launder proceeds of the Ronin Bridge, Harmony Horizon, and Nomad bridge thefts. **The behavioral finding worth keeping:** Lazarus is the actor sanctions moved least. After the 2022 designation it shifted to Sinbad.io; when Sinbad was seized in November 2023 it came straight back to Tornado Cash, laundering over $100 million from the HTX/HECO thefts beginning 13 March 2024 — while the protocol was still formally sanctioned. Legitimate users left under sanction; the sanctioned adversary did not. ## Stub — to build out Founding and organizational placement within DPRK intelligence, the Sony Pictures hack, the Bangladesh Bank heist, WannaCry, and the full cryptocurrency-theft ledger. ## Related - [[Tornado Cash]] · [[Money Laundering]] · [[Roman Semenov]]