Lazarus strikes again 👨‍💻

The North Korean hacking group has been fingered as the culprits behind this week's $36 million hack of crypto exchange Upbit.

Author

Stephen Graves
November 28, 2025

Together with

📝 What you need to know

This week’s $36 million hack of South Korean exchange Upbit has been attributed to North Korea’s Lazarus Group, the hacking outfit behind some of the biggest crypto hacks of all time.

The group has developed an arsenal of tactics including malware, infiltrators and even fake businesses—though researchers note that using “Lazarus Group” as a blanket term for all DPRK hacking operations is not entirely accurate.

The impact of large-scale hacks has financial regulators weighing their response. In Japan, the FSA is moving to mandate that crypto exchanges maintain liability reserves to protect customers from hacks.

Upbit Hack Attributed to North Korea's Lazarus as Seoul Opens Probe: Report

The breach has prompted a formal review of Upbit’s systems as regulators examine the Solana hot-wallet theft.

From our partner

The Rekt Invitational, powered by Yeet and Manors Golf, is a crypto-native golf tournament launching in Miami. Hosted by Rekt Brands Inc., the company behind $REKT, it will run as an ongoing global tournament series across crypto events, uniting culture, competition and community.

📰 In the News

Trump White House ‘World’s Most Corrupt Crypto Startup Operation’: House Democrats

President Trump and his family made $800 million from sales of cryptocurrencies in the first half of the year, according to a new report.

Balancer Outlines Reimbursement Plan Following $128M Exploit

Balancer has identified six whitehat actors who recovered approximately $3.9 million across multiple networks during the exploit.

Interpol Elevates Scam-Compound Network to Global Threat as Crypto Fraud Spreads

The aim is to confront global scam center systems that traffic workers, run large-scale online fraud, and channel billions through crypto.

📊 Myriad Market of the Day

Pump’s next move: Pump to $0.005 or Dump to $0.001?

Trade "Pump’s next move: Pump to $0.005 or Dump to $0.001?" on Myriad

💬 Quote of the Day

❝

“Donald Trump has turned the Oval Office into the world’s most corrupt crypto startup operation, minting staggering personal fortunes for him and his family in less than a year.”

Rep. Jamie Raskin (D-MD) on the release of a new report by House Judiciary Committee Democrats into the Trump family’s crypto dealings

🥇 Be First to Market With Myriad

Join the Myriad Markets Telegram to see the latest prediction markets the second they drop!

With Myriad, the on-chain prediction market launched by Decrypt’s parent company DASTAN, you can break the news and stake the news, using USDC and points.

🕵🏻‍♀️ Editor’s Picks

Malware Chrome Extension Secretly Siphoned Fees From Solana Traders for Months

Cybersecurity firm Socket warns the extension masks a second transaction instruction that quietly skims SOL from routine swaps.

Vitalik Buterin Donates $765K in Ethereum to Privacy Messaging Apps

Ethereum co-founder Vitalik Buterin supported two privacy messaging apps that are looking to break past sector leaders Signal and Telegram.

US AI and Data Firms to Testify in Chinese AI Espionage Probe

The U.S. is probing how Chinese operators used AI in a cyber-espionage campaign as experts warn similar tools could hit on-chain finance.

📚 Watch and Learn

📹️ WATCH: Borrowing Against Your Tesla Stock to Buy a Car Is the Future of DeFi: Superstate CEO Robert Leshner

Superstate founder and CEO Robert Leshner explains how tokenization will hit velocity when end users start to get excited about applications, like borrowing cash against stock to help fund a vehicle purchase.

🎓️ LEARN: What Is a Layer-1 Blockchain? The Base Layer Powering Bitcoin and Crypto

Layer-1 blockchains are the base networks that secure and record every crypto transaction, powering Bitcoin, Ethereum, and beyond.

Interested in partnering with Decrypt? Find out more here.