How to Check If Your Wallet Is Exposed to Lazarus Group (North Korea) Crypto

TL;DR - Run your address through an OFAC sanctions search and a multi-chain exposure screener; if funds trace back to a DPRK-linked wallet within a few hops, expect a freeze at any regulated exchange.

The Lazarus Group is the most aggressively tracked actor in crypto, and its stolen funds move fast and wide. After a major hack, laundered coins pass through mixers, bridges, and thousands of throwaway addresses, so a payment that looks ordinary can still carry exposure you never chose. This guide shows how to check your own wallet for a link to North Korea-attributed funds before an exchange does it for you.

Who is the Lazarus Group and why does it matter for your wallet?

Lazarus Group is a state-sponsored hacking operation tied to North Korea, often called the DPRK. Investigators and the FBI have linked it to some of the largest crypto thefts on record, including the Ronin bridge hack of more than 600 million dollars in 2022 and the Bybit theft reported at around 1.5 billion dollars in early 2025. The US Treasury's OFAC has added many of the wallets and services involved to its sanctions list.

This matters for an ordinary holder because sanctions exposure travels downstream. If coins that passed through a Lazarus-controlled wallet reach your address, a compliance screen at an exchange can flag the deposit even when you did nothing wrong. The rule that bites is strict liability: under OFAC, intent is not required for a violation.

How do North Korea's stolen funds reach an ordinary wallet?

After a hack, the goal is to break the trail between the stolen pile and a cash-out point. The laundering playbook is consistent:

• Mixers like Tornado Cash pool funds to hide the link between a deposit and a withdrawal.
• Cross-chain bridges hop value between Ethereum and other networks, which defeats naive single-chain tracing.
• Peel chains split a large sum across long sequences of small transfers.
• OTC brokers and small exchanges swap the laundered crypto for clean assets or fiat.

Cleaned funds get recycled back into the market, and that is where a normal user can pick them up - through a peer-to-peer trade, an OTC deal, or a withdrawal from a service that handled tainted coins. You can inherit exposure without ever touching a mixer yourself.

How do you check if your wallet is exposed to Lazarus funds?

Start with the free, manual checks, then widen the net:

1. Search your address on the OFAC Sanctions Search portal to confirm it is not directly listed.
2. Open your address on a block explorer such as Etherscan and look for an OFAC or sanctioned-entity label on any counterparty.
3. Trace the source of recent deposits by hand to see whether any funds arrived from a flagged wallet, a known mixer, or a bridge tied to a hack.

Manual tracing breaks down quickly. A block explorer shows only direct, single-chain labels, so it misses multi-hop links and exposure on other networks. Rather than checking one source at a time, screen your wallet with Plastron to see sanctions, mixer, and stolen-funds exposure across Ethereum and six other chains in a single pass.

What happens if your wallet has DPRK exposure?

If a regulated exchange screens an incoming deposit and finds a DPRK link in the transaction graph, the standard response is to freeze the funds, request a source-of-funds explanation, and file a suspicious activity report when the rules require it. Resolution can take weeks, and in clear sanctions cases the funds may not be returned at all.

Exposure is measured by proximity. A direct transfer from a sanctioned wallet is treated as the most severe case. An indirect link several hops away usually carries lower confidence, but a strong path to a North Korea-attributed cluster can still trigger a hold. The chart below shows how risk rises as the distance to the tainted source shrinks.

How can you reduce your exposure risk?

You cannot control who sent you funds in the past, but you can control what you accept next.

• Screen a counterparty address before any large peer-to-peer or OTC trade.
• Keep separate wallets so a single tainted deposit does not contaminate your main balance.
• Save screening records and transaction notes so you can answer a source-of-funds request quickly.
• Avoid services that recycle funds with no compliance checks, such as anonymous swap desks.

Regular checks turn a surprise freeze into a known risk you can plan around.

FAQ

Can my wallet be sanctioned just for receiving Lazarus funds?

Your address is unlikely to be added to the SDN list for a single unsolicited deposit, but the funds can still be frozen and your account reviewed. OFAC liability does not require intent, so keep a record of anything you receive.

How many hops from a Lazarus wallet still count as exposure?

There is no fixed legal number. Direct transfers are the most serious, while exposure usually weakens with each hop. A short, high-value path to a sanctioned cluster carries the most weight in most screening models.

Does an OFAC search cover North Korea-linked addresses on every chain?

No. The OFAC portal returns exact matches on listed addresses only. A multi-chain screener is needed to catch the same actor across Ethereum, Arbitrum, Base, Optimism, Polygon, BNB Chain, and Avalanche.

What should I do if I think I received DPRK-linked crypto?

Stop moving the funds, screen the address to confirm the exposure, and keep records. If you must report to an exchange or an authority, a clear timeline of how the funds arrived will help your case.