Lykke

lazarus.day

On June 4, centralized cryptocurrency exchange Lykke suffered a security breach that resulted in the theft of over $22 million in crypto assets. The exchange initially halted withdrawals—citing unscheduled maintenance—and was later accused by researcher SomaXBT of concealing the incident, noting that approximately $19.5 million had already disappeared. On June 10, Lykke officially confirmed the hack affecting both its UK and Corp AG operations, assured users that their funds were safe due to solid capital reserves, and pledged to recover the lost assets. The exchange also revealed it had identified the attacker’s IP, launched a criminal investigation, and employed a cybersecurity team to block and recover the stolen funds

tayvano/lazarus-bluenoroff-research

Date:: 2024-06-04; Amount Stolen:: $23,000,000; Tags:: ❓DPRK (Unidentified). "Attributed in MSMT..." "This was also attributed by bro Whitestream (lol)"

Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025

Table 2: DPRK Cryptocurrency Thefts, January - December, 2024. Date: 2024-06-04; Victim: Lykke; DPRK APT: DPRK (Unidentified); Amount ($ Million): 22.4. Report: "In coordination with Chainalysis and Mandiant, MSMT Participating States have attributed the cryptocurrency heists in tables 2 and 3 to DPRK actors."

The article says Lazarus was identified as a potential culprit by OFSI-related reporting and separately blamed by Whitestream, while noting that other researchers dispute whether the attacker can currently be determined.

2024-06-04 Lykke DPRK (Unidentified) 22.4