In February, North Korean hackers broke headlines with what is now regarded as the largest single hack in crypto history.

The Lazarus Group stole at least $1.4 billion from Bybit and later funneled those funds to crypto mixers.

“Someone had pulled off the biggest hack in [crypto] history, and we had a front-row seat,” Samczsun, Research Partner at Paradigm, recalled in a blog post.

The researcher said they witnessed the theft in real-time and collaborated with Bybit to confirm the unauthorized access.

Samczsun was working with SEAL 911, an emergency response unit affiliated with the Security Alliance, a nonprofit organization dedicated to securing decentralized systems.

But these attacks aren’t all just about the Lazarus Group. There’s more to North Korea’s cyber offensives than previously thought.

There’s a misconception about how to “classify and name” the group’s operations.

While the term “Lazarus Group” is “colloquially acceptable,” discussing how the DPRK (Democratic People’s Republic of Korea) runs its cyber operations on the offensive needs more rigor, Samczsun claimed.

Lazarus Group has become the preferred term by the media when describing DPRK cyberactivity. Cybersecurity researchers “created more precise designations” to show which ones are working on specific activities, they added.

A hacking bureau

The DPRK’s hacking ecosystem operates under the Reconnaissance General Bureau (RGB), which houses several distinct groups: AppleJeus, APT38, DangerousPassword, and TraderTraito

These groups operate with specific targeting methodologies and technical capabilities.

TraderTraitor, identified as the most sophisticated DPRK actor targeting the crypto industry, focuses on exchanges with large reserves and employs advanced techniques, successfully compromising Axie Infinity through fake job offers and manipulating WazirX.

AppleJeus specializes in complex supply chain attacks, including the 2023 3CX hack that potentially affected 12 million users.

Dangerous Password, meanwhile, conducts lower-end social engineering through phishing emails and malicious messaging on platforms like Telegram.

Another subgroup, APT38, spun out of Lazarus in 2016 and focused on financial crimes. It first targeted traditional banks before shifting attention to crypto platforms.

In 2018, the OFAC first mentioned “North Korean IT workers,” which in 2023 were identified by researchers as “Contagious Interview” and “Wagemole,” operating through schemes where the threat actors either pose as recruiters or attempt to get hired by target companies.

There’s still hope

While the DPRK has shown its ability to deploy zero-day attacks, there have been “no recorded or known incidents” of it deploying directly against the crypto industry, Samczsun said.

The researcher urged crypto companies to implement basic security practices such as least privilege access, two-factor authentication, and device segregation. If preventive measures fail, connecting with security groups like SEAL 911 and the FBI’s DPRK unit would also be helpful.

“DPRK hackers are an ever-growing threat against our industry, and we can’t defeat an enemy that we don’t know or understand,” Samczsun wrote.

Edited by Sebastian Sinclair

Why did Joseph Maldonado-Passage, better known as Joe Exotic from the viral Netflix docuseries “Tiger King,” debut a meme coin on Solana from prison earlier this week?

“I’m knee-deep in lawyer bills,” he told Decrypt in an interview, claiming the endeavor will also benefit children through donations to a nonprofit called Operation Smile.

The 62-year-old, who has lived behind bars for seven years, didn’t launch the meme coin himself. Instead, he said his lawyers helped him get “Official Tiger King” off the ground, which began trading under the ticker name EXOTIC on Monday.

Most celebrity meme coins end up as flash in the pan. Their value often hinges on people’s attention, which can fade quickly. Others end up marred by allegations of insider trading. Exotic said he’s hopeful that his token doesn’t end up becoming yet another example.

“I pray to god that they don’t rug it and ruin my reputation,” the former wildlife park owner said. “I’m hoping that people will see this is legit and it has a purpose.”

Celebrity meme coins, while nothing new, reached a boiling point last year, with names like Caitlyn Jenner, Jason Derulo, and Cardi B stepping into the space. Hailey Welch, also known as “Hawk Tuah girl,” was among those that got caught flat-footed. Her coin, dubbed HAWK, became a fiasco after it imploded. A spokesperson told Decrypt she “had zero control over it.”

EXOTIC debuted on a little-known launchpad called pumpkin.fun. The meme coin’s market cap initially surged to $900,000 but has since fallen to just over $100,000, according to the crypto data provider GeckoTerminal. It has less than 900 holders in total, per blockchain data.

The website for Exotic’s meme coin does not reference the project’s goal of contributing funds to Operation Smile. However, it does say tokens will be donated to a “foundation supporting tigers or animal health” upon his release from prison. On Friday, Exotic’s account on X, formerly known as Twitter, said it had already donated $1,000 to the nonprofit.

Exotic says his lawyers got behind the idea of launching a meme coin as a way to showcase his commitment to charitable work. That’s a reason for him to be free, he said, as opposed to “sitting in here, watching people do drugs all day.”

Project Smiles and Exotic’s lawyers did not respond to requests for comment from Decrypt.

Exotic is currently being held at FMC Fort Worth, an administrative security center, according to the U.S. Federal Bureau of Prisons He routinely uses the telephone to connect with the outside world, keeping fans up-to-date via podcasts and X Spaces.

When it comes to crypto, Exotic has been able to absorb a lot, even learning from other inmates. While familiar with key terms, his real-word experience is admittedly limited.

“There’s not a lot to do all day besides sit and talk to people who know shit,” he said. “I do a lot from here, but I don’t even know how to set up a wallet.”

In 2021, Joe Exotic was resentenced to 21 years in federal prison, per the Associated Press. He was convicted of a murder-for-hire scheme against animal welfare activist Carole Baskin, killing five tigers, selling tiger cubs, and falsifying wildlife records.

Exotic maintains his innocence, while also pressing U.S. President Donald Trump for a pardon on social media.

In 2021, an unofficial meme coin called “Tiger King Coin” was launched as well. Exotic said he was entitled to receive 1% of its supply, but never found out who was behind the project. He fears that coin may influence people’s perceptions of the one that just launched. 

Operation Smile, founded in 1982, provides cleft lip and palate repair surgeries for children across the world. Exotic hopes his meme coin can ultimately help that initiative moving forward.

“People really need to invest in it,” he said. “I would like to be able to get it up there to where I can fix 500 kids’ [faces] and pay my lawyer bills.”

Edited by Andrew Hayward

Bitcoin swung up and down—as usual—over the last week, and while things were looking up midweek, familiar inflation fears helped sink the price by the time Friday rolled around.

The coin’s price was recently at $82,480 per coin, according to CoinGecko, after hitting a nearly three-week high of $88,474 on Monday. As of this writing, Bitcoin is now down by almost 2% on the week.

Bitcoin’s dip came after the U.S. Commerce Department reported Friday that the core Personal Consumption Expenditures Price Index, or PCE, was up 0.4% in February—its largest monthly increase in over a year.

Traders are still hesitant with risk-assets like Bitcoin and stocks (which also dropped Friday) as persistent inflation and President Trump’s trade war continue to unsettle the markets. Still, it was an interesting week for Bitcoin.

ETF action

American Bitcoin ETFs took in new investor cash each day from Monday through Thursday, Farside Investors data shows—but finally showed red on Friday amid the broader markets shock.

Even so, the week’s total inflows ended up in the green at approximately $196.4 million. It may not sound like much, but after massive outflows last month, it looks like crypto investors are seeing Bitcoin’s current price—24% below its January all-time high—as a buying opportunity.

GameStop hungry for orange coin

Video game retailer and popular meme stock GameStop updated its Investment Policy on Tuesday to inform investors that it would add “certain cryptocurrencies, including Bitcoin” to its balance sheet.

The firm then said Wednesday that it would follow in the footsteps of Strategy (formerly MicroStrategy) and raise money from investors in the form of debt to buy the asset. GameStop aims to raise $1.3 billion to aid in its Bitcoin acquisition goal.

GameStop first made headlines in 2021 when amateur traders started buying its moribund stock and pumping its price—leading to the meme stock phenomenon.

It’s now trying to strengthen its books by buying “digital gold.” But while the price of GME stock rose on the initial news this week, it’s since plunged following word of the raise, as GameStop investors don’t seem too keen on raising money for the ploy.

Miners hit Florida

Bitcoiners arrived in Fort Lauderdale this week for the world’s biggest mining conference: Mining Disrupt.

Engineers from the top manufacturing companies and vendors pushed a narrative that miners should be dipping their toes into the world of AI data centers to raise their game as BTC’s price dips and difficulty continues to climb.

Decrypt was there to see if it really was as simple as that, and also learned that small businesses are tempted to start the trade in their backyard—but not by mining BTC: DOGE ASICs are still hot, apparently.

Brazil to buy Bitcoin?

The world’s richest country may be keen on stacking sats via a strategic reserve—but will the move inspire other nation states?

In short, it looks like it: Brazil, the second biggest economy in the America’s and biggest in Latin America, might be doing so soon.

Pedro Giocondo Guerra, a bigwig in leftist President Inácio Lula da Silva’s administration, said that buying and holding Bitcoin would be “in the (country’s) public interest.”

Guerra, who is chief of staff to Vice President Geraldo Alckmin, made the comment at a congressional ceremony.

Brazil has a huge crypto market—the biggest in South America—and the Brazilian real was the worst-performing major currency last year. Politicians could be seeing an opportunity.

Trump video debunked

Here’s a fun one to end the week: An obviously doctored video of President Trump started making the rounds on Facebook and Crypto Twitter, showing him cracking out the Bitcoin whitepaper in the Oval Office.

Of course, it wasn’t real—but it riled up some Bitcoin supporters. And while Trump has recently embraced Bitcoin and cryptocurrency, he’s hardly a longtime aficionado, having previously been a skeptic who called it a “scam” and said he was “not a fan” of Bitcoin.

Edited by Andrew Hayward