DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

BigONE

Date (as written)
2025-07
Year
2025
Country
Seychelles
Actors (as written)
Lazarus
Actor pages
Lazarus
Tags (as written)
Cryptocurrency FinancialGain
Dollar figures (as written)
$27 million; $27,000,000; 27 ($ Million)

Source entries (3)

lazarus.day

BigONE · 2025-07
On July 16, 2025, cryptocurrency exchange BigONE suffered a third-party attack on its hot wallet, resulting in an estimated loss of about $27 million across multiple assets including BTC, ETH, USDT, SOL, DOGE, and SHIB. The attack path was quickly identified and contained, with all private keys remaining secure. BigONE is collaborating with SlowMist to trace the hacker’s addresses and monitor stolen funds, while activating internal security reserves and external liquidity sources to fully cover the losses and ensure users are not materially affected. Deposit and trading services are being restored, while withdrawals will resume after additional security reinforcements.
https://lazarus.day/incidents/bigone/

tayvano/lazarus-bluenoroff-research

BigONE · 2025-07-15
Amt Stolen: $27,000,000
https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/bigone.md

Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025

BigONE · 2025-07-15
Table 3: DPRK Cryptocurrency Thefts, January - September, 2025. Date: 2025-07-15; Victim: BigONE; DPRK APT: TraderTraitor; Amount ($ Million): 27. Report: "In coordination with Chainalysis and Mandiant, MSMT Participating States have attributed the cryptocurrency heists in tables 2 and 3 to DPRK actors."
https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/pdfs/2025-10-22_MSMT-Report.pdf

Suggest a correction on GitHub