Lazarus Group allegedly makes a profit of $2.51m from selling WBTC

North Korea’s Lazarus Group allegedly made a profit of $2.51 million after selling 40.78 Wrapped Bitcoin that was bough two years ago.

According to data from SpotOnChain, a wallet believed to belong to the North Korean hacker group has just sold 40.778 WBTC (WBTC), valued at $3.51 million, for 1,847 Ethereum (ETH).

After the purchase, the wallet distributed 2.507 ETH from its total holdings into three separate wallets in batches of 205 ETH, 500 ETH and finally 1,865 ETH into another Lazarus Group-linked address.

Today, the Lazarus Group (North Korean hackers) sold 40.78 $WBTC ($3.51M) for a $2.51M profit (+251%)—after buying it 2 years ago.

They spent 999.9K $USDT to acquire the $WBTC at ~$24,521 in Feb 2023, and sold it for 1,857 $ETH at ~$86,170 just 12 hours ago.

The hackers then… pic.twitter.com/KYQmqnJnIC

— Spot On Chain (@spotonchain) April 3, 2025

On February 2023, the wallet spent approximately 999,900 USDT (USDT) to buy 40.78 WBTC. At the time of purchase, the average price of WBTC stood at $24,521. According to data from crypto.news, Wrapped Bitcoin has gone up by more than 240% compared to two years ago. At press time, WBTC is trading hands at $83,459.

When the wallet made the purchase, WBTC was valued at an average price of $86,170. Therefore, it was able to make a profit of $2.51 million in realized gains or equal to 251% after holding on to 40.78 WBTC for around two years.

Price chart depicting Wrapped Bitcoin price movements in the past three months, April 4 2025 | Source: crypto.news You might also like: Lazarus Group sends $3.76m worth of Bitcoin to five unknown address

The Lazarus Group’s on-chain activities

Wallets allegedly belonging to the notorious Lazarus Group from North Korea has been under constant surveillance by on-chain data analysis organizations, specifically after its hack on the crypto exchange Bybit. The group’s wallets have been laundering funds accumulated from its crypto hacks by swapping it with different cryptocurrencies and distributing them across various wallets.

On March 4, the group had reportedly succeeded in laundering nearly 500,000 ETH or equal to $1.39 billion worth of stolen funds from the Bybit hack in just 10 days. The cross-chain decentralized liquidity platform THORChain was used to process at least $605 million of the funds in a single day alone.

According to data on Arkham Intelligence, a wallet linked to the Lazarus Group holds around $1.1 billion in crypto holdings, with a majority of them stored in Bitcoin (BTC), Ethereum and Tether.

As previously reported by crypto.news, Google Threat Intelligence Group detected an increase in North Korean IT workers efforts to infiltrate tech and crypto companies in various countries across Europe. These IT workers would often act as insider entry points for state-sponsored hacking groups like Lazarus Group.

Read more: North Korean IT workers ramp up infiltration of tech and crypto firms across Europe

Source