Australia Imposes Sanctions on North Korean Lazarus Group for $1.9 Billion Crypto Theft

Australia has taken significant action against North Korean cybercrime networks, announcing extensive sanctions targeting the notorious Lazarus Group among others, due to their involvement in the theft of approximately A$1.9 billion (about $1.23 billion) in cryptocurrency last year. This strategy aims to undermine North Korea's development of weapons of mass destruction funded through digital crimes.

Key Takeaways

Australia has imposed sanctions on four North Korean hacker groups, including Lazarus, in response to significant cryptocurrency thefts.
These sanctions are part of a broader strategy to curb North Korea's weapons of mass destruction programs.
The Lazarus Group and other hackers have laundered stolen crypto using a network of North Korean nationals.
Crypto theft by North Korea increased significantly in 2024 compared to 2023.

Lazarus Crypto

Australia’s Action Against Cybercrime Syndicates

In a strong response to North Korean cybercrime activities, Australia has announced extensive sanctions against four entities, including the notorious Lazarus Group. This action targets the theft of at least A$1.9 billion ($1.23 billion) in cryptocurrency from various companies globally in 2024.

Australian Minister for Foreign Affairs, Penny Wong, disclosed these sanctions on Thursday, emphasizing their goal to disrupt North Korea's secretive programs related to weapons of mass destruction (WMD) that are funded through digital theft and illegal cryptocurrency activities.

“The scale of North Korea’s involvement in malicious cyber-enabled activities, such as cryptocurrency theft, fraudulent IT operations, and espionage, is extremely worrying,” the statement highlighted.

These sanctions were announced in response to warnings from North Korea that similar sanctions from the U.S. could provoke a backlash against their leadership.

Major Cybercriminal Groups Targeted

The sanctions have specifically identified four hacking groups controlled by the Reconnaissance General Bureau, which is North Korea's intelligence agency. These groups include Lazarus, Kimsuky, Andariel, and Chosun Expo. Additionally, an individual hacker, Park Jin-hyok from Chosun Expo, has also been sanctioned. Park has previously faced sanctions from both South Korea and the United States.

Park Jin-hyok

According to the release, North Korean cybercriminals managed to steal at least A$1.9 billion in cryptocurrencies during 2024 alone, utilizing a widespread network of North Korean nationals to wash their stolen digital assets.

A report from the Multilateral Sanctions Monitoring Team notes that the stolen cryptocurrency in 2024 was 50% more than that taken in 2023. Furthermore, from January to September 2025, North Korea reportedly stole at least $1.645 billion in crypto, already exceeding its total theft estimate for 2024.

Minister Wong stated, “We are all conscious of the risks and threats posed by North Korea to the region. Therefore, we are continuously exploring ways to collaborate with other partners to apply pressure on the regime, and cutting off their funding sources is obviously a critical component of that strategy.”