FBI Lazarus Group (DPRK)
live dataFBI-attributed cryptocurrency addresses for the DPRK Lazarus / APT38 / TraderTraitor group.
Rows in labels.db
22
Confidence
1.0
Refresh cadence
Daily (OpenSanctions refreshes when the FBI publishes a new PSA)
Schema
flat
About this source
The FBI periodically publishes Public Service Announcements naming specific cryptocurrency addresses attributed to the Democratic People's Republic of Korea Lazarus Group, also tracked as APT38 / TraderTraitor. The August/September 2023 Stake.com PSA consolidated 33 addresses (22 BTC plus altcoins) across the Alphapo / CoinsPaid / Atomic Wallet / Stake.com heists; subsequent PSAs (Bybit 2025-02-26 and others) add more rows as new heists are attributed. Because fbi.gov sits behind a Cloudflare bot challenge that returns 403 to all non-browser clients, we route through OpenSanctions's us_fbi_lazarus_crypto dataset, which mirrors the FBI list verbatim with structured currency tagging.
How we got the data
Daily fetch of data.opensanctions.org's us_fbi_lazarus_crypto/entities.ftm.json, filtered to currency=Bitcoin CryptoWallet entities. Other-chain rows (ETH / BSC / Polygon) in the same dataset are not ingested today since our address corpus is Bitcoin-only.
Why this confidence
Nation-state attribution by a U.S. federal law-enforcement agency. Same compliance grade as OFAC. Reproducible from the OpenSanctions dataset, which itself cites the originating FBI PSA URLs for every row.
License & attribution
OpenSanctions data is published under Creative Commons Attribution. We retain a per-row source_ref pointing back to the OpenSanctions dataset, which preserves the underlying FBI PSA citation.
Sample addresses
Highest-confidence rows from this source, picked live from labels.db. Click any address to see its full /address aggregator entry.
| Address | Label | Confidence |
|---|---|---|
| bc1qqvpjgaurtnhc8smkmdtwhx9c8207m0prsyxyjx | FBI-attributed DPRK / Lazarus Group laundering wallet | 1.00 |
| bc1qy0ggpxu8f6lta6vf44vervr4py2uu829grj8yh | FBI-attributed DPRK / Lazarus Group laundering wallet | 1.00 |
| bc1qfesn3jj65fhmf00hh45ueql8je8jae6ep3qk84 | FBI-attributed DPRK / Lazarus Group laundering wallet | 1.00 |
| bc1qg0qygyv3qfp8cjyy99ch9vc9dp876vl8wys67u | FBI-attributed DPRK / Lazarus Group laundering wallet | 1.00 |
| bc1qqydp9muxtnxyet3ryfqc467wjtm23f0r7eh5aa | FBI-attributed DPRK / Lazarus Group laundering wallet | 1.00 |
| bc1qqa682d2q0wtx5gfpxh4yfl9s4k00ukakl5fpk5 | FBI-attributed DPRK / Lazarus Group laundering wallet | 1.00 |
| bc1qtnuzecpqaakj0dt855n24dv7u5pme7vyct2cf2 | FBI-attributed DPRK / Lazarus Group laundering wallet | 1.00 |
| bc1qy78e6ml7f3p438jqrrlzsewx625y0sr7jsesa7 | FBI-attributed DPRK / Lazarus Group laundering wallet | 1.00 |
See the data live
Every row from this source is queryable through the /address aggregator and the JSON API.
JSON API Cross-sourceWant this as a feed?
Same data drives the Address Monitoring API: real-time inflow / outflow events on these addresses as they confirm.
About the API