FBI blames North Korea’s Lazarus Group for $40M Stake hack

While it’s unclear how they made the determination, the FBI has concluded the Lazarus Group is responsible for the Stake hack


Dzelat/Shutterstock modified by Blockworks


The Federal Bureau of Investigation announced their finding in a press release on Wednesday that the notorious North Korean-funded Lazarus Group is responsible for the $41 million exploit of gambling platform Stake.com. It is unclear how the FBI made this determination. 

The announcement included a list of associated blockchain addresses. The agency wrote that “private sector entities are encouraged to review the previously released Cyber Security Advisory on TraderTraitor and examine the blockchain data associated with the above-referenced virtual currency addresses and be vigilant in guarding against transactions directly with, or derived from, those addresses.”

Stake was exploited for over $40 million across three different blockchains on Sept. 4. Hackers swapped various assets, spread them between addresses, and eventually sent large sums to the Avalanche blockchain via bridges, before converting synthetic BTC on Avalanche to native BTC – a conversion process that can potentially anonymize the transactions and make them more difficult to trace. 

The Stake team has been notably quiet about the incident. There has been a lone Tweet from the official Stake account in which the team stated that “user funds are safe.” The company’s CEO, Ed “Eddie” Craven, joined a popular Twitch streamer earlier today to suggest that the streamer travel to North Korea to negotiate a return of funds. 

Loading Tweet..

It is not immediately apparent how the FBI came to the conclusion that Lazarus was the entity behind the attack. While Lazarus is known to use mixers, it is not uncommon for other hackers to deploy the same tools in order to cover their tracks. 

A Stake representative did not respond to a request for comment by press time. 

Various government entities have been staking claim to greater on-chain analytical sophistication in recent months. In July, representatives for the SDNY bragged in a press release about tracking assets across various blockchains, saying “none of those actions covered the defendant’s tracks or fooled law enforcement, and they certainly didn’t stop my Office or our law enforcement partners from following the money.”

Don’t miss the next big story – join our free daily newsletter.


Upcoming Events

MON - WED, MARCH 18 - 20, 2024

Digital Asset Summit (DAS) is returning March 2024. What you can expect: And more! Don’t miss out on the opportunity to be in the room when the future of crypto is decided. Join us and help shape the future of our […]

recent research

Research report - cover graphics-2.jpg


Base has doubled-down on its commitment to the Superchain vision, has shown early signs of success with nearly $400M in TVL, and has become home to novel dapps such as friend.tech which has seen significant traction.


Maker’s DeFi-focused “subDAO” passed a proposal activating a lending market for DAI on the Gnosis Chain


Certain creditors could be repaid sooner, with one hedge fund exec telling Blockworks it expects a payout by the end of the year


Busan is South Korea’s second largest city with a population around 3.4 million


Cyprus granted eToro crypto registration, setting the groundwork for the company to operate crypto services post-MiCa rollout



These are the best tools and practices you can leverage to defend against crypto market volatility


The agency alleges around 1,160 customers used the margin product, losing about $8.35 million since Oct. 2021.