A wallet linked to North Korea's Lazarus Group sold 911 ETH, worth about $2.28 million, at an average price of $2,499 over a two-hour window, according to on-chain tracking. The size and pace of the sale — a steady drip rather than a single block trade — fits the pattern the group has used repeatedly to convert stolen crypto into spendable value without moving the market against itself.
Lazarus Group has spent the better part of two years working through the aftermath of the February 2025 Bybit hack, in which roughly 500,000 ETH — worth about $1.4 billion at the time — was stolen after attackers compromised a third-party wallet interface used by the exchange. Within ten days of that theft, the group had already routed the large majority of the stolen ETH through THORChain, converting most of it into Bitcoin and scattering the proceeds across thousands of wallets to frustrate tracing. More than a year later, that laundering effort is still running: 2026 has seen the group continue moving remaining balances through cross-chain bridges, decentralized exchanges, and mixing services, and Bybit's own chief executive has said a meaningful share of the original haul remains traceable on-chain even now.
This particular 911 ETH sale is a small fraction of that total, but it illustrates why on-chain analysts keep such close watch on wallets tied to the group. Lazarus doesn't move stolen funds in a way that draws attention — spreading sales across hours rather than dumping in one transaction is a deliberate choice that limits slippage and keeps any single trade from standing out on an exchange's order book. Multiply that pattern across the hundreds of wallets the group is believed to control from various past thefts, and the group's total footprint on-chain becomes a slow, ongoing drain rather than a single dramatic event.
The persistence of this activity is itself the story. Years after a hack makes headlines, the actual laundering and liquidation of the proceeds continues in increments too small to individually move markets but large enough, in aggregate, to represent one of the more durable sources of sell pressure tied to a single actor in the ETH market. Analysts tracking Lazarus-linked addresses have noted that a meaningful share of funds from its various hacks — the Bybit theft chief among them — remains parked on-chain rather than fully cashed out, which means episodes like this 911 ETH sale are likely to keep recurring rather than mark an endpoint.
The Bybit case remains the largest single reference point for how this group operates at scale, but it is far from the only one. Lazarus-linked operations have been tied to a string of exchange and bridge exploits over the past several years, and the group's playbook rarely changes much between them: gain access through a compromised interface or supply-chain weakness rather than breaking a blockchain's own cryptography, move the stolen assets quickly through a cross-chain route that fragments the trail across multiple networks, and then let the resulting balances sit for months or years before trickling them back into liquidity through exactly the kind of measured, hours-long sale seen here. That patience is itself a defensive tactic — a wallet that sells everything at once draws immediate scrutiny, while one that sells 911 ETH in a quiet two-hour window barely registers against Ethereum's broader daily trading volume.
For now, the sale adds a small, verifiable data point to a much larger and still-unfolding story: a state-linked hacking operation working, transaction by transaction, through the proceeds of one of the largest crypto thefts on record, one two-hour window at a time. It also underscores why blockchain analytics firms continue to treat address-labeling and wallet clustering as a frontline defense — without that tracking, a sale this size would likely pass unnoticed rather than serve as one more confirmed data point in a years-long paper trail. Related coverage: OFAC's Xinbi sanctions exposed a separate North Korea-linked laundering network, while on the broader ETH whale front, one mystery whale recently exited an entire 167,855 ETH position over five days and a separate pair of wallets moved $126 million in ETH in a pattern echoing BitMine's own treasury activity.
Related: ETH Whale Sells 6,000 ETH to Pay Down Aave Loan After 2x Leverage Bet
