A North Korea crypto check screens a wallet against addresses tied to OFAC-sanctioned DPRK groups like Lazarus; Plastron flags this exposure free using weekly-updated sanctions data across seven EVM chains.

North Korea's state-sponsored hacking group, Lazarus Group, is estimated to have stolen over $3 billion in cryptocurrency between 2017 and 2024, making DPRK the single largest state-level threat to blockchain ecosystem security. Their operations include the $625 million Ronin Bridge hack (2022), the $1.5 billion Bybit hack (2025), and dozens of smaller but significant exchange and DeFi protocol breaches. OFAC has designated Lazarus Group, the Blueberry Protocol addresses, and numerous associated wallet addresses on the SDN list, meaning any transaction involving these addresses by a US person or on a US-nexus platform is a sanctions violation — not merely an AML concern. After each hack, Lazarus rapidly moves stolen funds through multiple intermediary wallets, DEX swaps, and mixing services in an effort to obscure the origin before cashing out. This distribution process means that stolen DPRK-linked funds filter into the broader DeFi ecosystem within weeks of a hack, reaching wallets that had no connection to the original attack. Major exchanges apply heightened scrutiny to wallets with any DPRK exposure given both the sanctions obligations and the scale of DPRK theft activity. South Korean VASP regulations specifically mandate DPRK screening for all registered exchanges. Screening your wallet for Lazarus Group exposure is particularly important if you have been active in DeFi in the weeks following any major hack.