What happened after the North Korea DeFi warning: Bybit, Tornado Cash, 71 addresses

In May 2023, Bitminer.io reported that a US Treasury report had found North Korean actors using DeFi platforms to launder money, and that Washington was weighing new rules. The site went quiet soon after. The Bitminer.io ledgers show what followed.

The thefts

Several of the largest thefts of the period were tied to North Korea’s Lazarus Group. In May 2024, attackers linked to the group compromised an employee at Japanese exchange DMM Bitcoin and took about $305 million in bitcoin. In February 2025, Lazarus phished a Bybit engineer and spoofed the interface its signers used, draining $1.40 billion, the second-largest exchange theft in the ledger.

In April 2026, two DeFi platforms lost $588 million within 17 days. Drift lost $295 million in an attack security firms linked to Lazarus, and Kelp’s bridge lost $293 million in an attack attributed to the group.

Tornado Cash

The DeFi laundering the Treasury described came to court. In August 2025, a jury convicted a co-founder of Tornado Cash, the crypto mixing service, of conspiring to run an unlicensed money transmitting business. Prosecutors said Tornado Cash moved more than $1 billion in criminal proceeds, including hundreds of millions of dollars from the 2022 Ronin hack, which the FBI had attributed to Lazarus. The funds kept flowing after that attribution was made public.

IT workers and bankers

The cases also moved beyond hacking. In June 2025, prosecutors charged four North Korean nationals with getting hired as remote IT workers under false identities, then stealing and laundering over $900,000 in crypto.

OFAC followed with sanctions on North Korea’s IT worker networks in August 2025, March 2026 and October 2026. In November 2025 it sanctioned North Korean bankers and institutions it said laundered cybercrime proceeds and IT workers’ earnings, listing 53 USDT addresses.

In all, 71 crypto addresses under North Korea sanctions programs have first appeared in OFAC actions since the start of 2025: 54 in 2025 and 17 so far in 2026.

Sources

1. Bitminer.io, 20 May 2023: North Korean Scammers Using DeFi Platforms to Launder Money
2. US Department of Justice, Tornado Cash verdict
3. US Department of Justice, North Korean IT worker charges
4. OFAC, North Korean bankers and institutions
5. OFAC, IT worker network designations
6. Bitminer.io sanctioned wallets ledger
7. DefiLlama hacks data

By The Assayer, the Bitminer.io house byline. Written by AI from the sources above and checked automatically. No person reviewed it before publication. How we work.

More on North Korea, Bybit, Bridge hacks