FBI Lazarus Group (DPRK)
live dataFBI-attributed cryptocurrency addresses for the DPRK Lazarus / APT38 / TraderTraitor group.
Rows in labels.db
22
Confidence
1.0
Refresh cadence
Daily (OpenSanctions refreshes when the FBI publishes a new PSA)
Schema
flat
About this source
The FBI periodically publishes Public Service Announcements naming specific cryptocurrency addresses attributed to the Democratic People's Republic of Korea Lazarus Group, also tracked as APT38 / TraderTraitor. The August/September 2023 Stake.com PSA consolidated 33 addresses (22 BTC plus altcoins) across the Alphapo / CoinsPaid / Atomic Wallet / Stake.com heists; subsequent PSAs (Bybit 2025-02-26 and others) add more rows as new heists are attributed. Because fbi.gov sits behind a Cloudflare bot challenge that returns 403 to all non-browser clients, we route through OpenSanctions's us_fbi_lazarus_crypto dataset, which mirrors the FBI list verbatim with structured currency tagging.
How we got the data
Daily fetch of data.opensanctions.org's us_fbi_lazarus_crypto/entities.ftm.json, filtered to currency=Bitcoin CryptoWallet entities. Other-chain rows (ETH / BSC / Polygon) in the same dataset are not ingested today since our address corpus is Bitcoin-only.
Why this confidence
Nation-state attribution by a U.S. federal law-enforcement agency. Same compliance grade as OFAC. Reproducible from the OpenSanctions dataset, which itself cites the originating FBI PSA URLs for every row.
License & attribution
OpenSanctions data is published under Creative Commons Attribution. We retain a per-row source_ref pointing back to the OpenSanctions dataset, which preserves the underlying FBI PSA citation.
Sample addresses
Up to 22 representative rows from this source, picked live from labels.db. Addresses appearing in the current rich-list snapshot are surfaced first, sorted by balance. Click any address to see its full /address aggregator entry.
| Address | Label | Balance (BTC) | Confidence |
|---|---|---|---|
| bc1qqvpjgaurtnhc8smkmdtwhx9c8207m0prsyxyjx | FBI-attributed DPRK / Lazarus Group laundering wallet | — | 1.00 |
| bc1qy0ggpxu8f6lta6vf44vervr4py2uu829grj8yh | FBI-attributed DPRK / Lazarus Group laundering wallet | — | 1.00 |
| bc1qfesn3jj65fhmf00hh45ueql8je8jae6ep3qk84 | FBI-attributed DPRK / Lazarus Group laundering wallet | — | 1.00 |
| bc1qg0qygyv3qfp8cjyy99ch9vc9dp876vl8wys67u | FBI-attributed DPRK / Lazarus Group laundering wallet | — | 1.00 |
| bc1qqydp9muxtnxyet3ryfqc467wjtm23f0r7eh5aa | FBI-attributed DPRK / Lazarus Group laundering wallet | — | 1.00 |
| bc1qqa682d2q0wtx5gfpxh4yfl9s4k00ukakl5fpk5 | FBI-attributed DPRK / Lazarus Group laundering wallet | — | 1.00 |
| bc1qtnuzecpqaakj0dt855n24dv7u5pme7vyct2cf2 | FBI-attributed DPRK / Lazarus Group laundering wallet | — | 1.00 |
| bc1qy78e6ml7f3p438jqrrlzsewx625y0sr7jsesa7 | FBI-attributed DPRK / Lazarus Group laundering wallet | — | 1.00 |
| bc1q32dzmf4t5a3xxvyxn07scgpmjznnz3kwjhw8uc | FBI-attributed DPRK / Lazarus Group laundering wallet | — | 1.00 |
| bc1qmqgkxzzfzjqepptw9xzxy03672xg55q559fmvr | FBI-attributed DPRK / Lazarus Group laundering wallet | — | 1.00 |
| bc1qdjmwm8q74r0yx99nghaeu33xdmz3lqnt2uspqv | FBI-attributed DPRK / Lazarus Group laundering wallet | — | 1.00 |
| bc1qvjpgxa2g3nvyw2hnclptextllu9dr4vkew8jfp | FBI-attributed DPRK / Lazarus Group laundering wallet | — | 1.00 |
| bc1q6w7qlaj3mfkgfrxwtvhw45cu86wew7xpjfqcmy | FBI-attributed DPRK / Lazarus Group laundering wallet | — | 1.00 |
| bc1qfcl8a4ck7uu3phgg5fj6g9servp6f85j3frcd3 | FBI-attributed DPRK / Lazarus Group laundering wallet | — | 1.00 |
| bc1qe4n22sduyylws74aewc6y6g32nglvglqu7hted | FBI-attributed DPRK / Lazarus Group laundering wallet | — | 1.00 |
| bc1qtalh4l8qc0p2qw70axxjhwu9z7rm93td5sgsl3 | FBI-attributed DPRK / Lazarus Group laundering wallet | — | 1.00 |
| bc1qc593a4d2hznk2ext3k2zmpdrqazlhhh80m4xas | FBI-attributed DPRK / Lazarus Group laundering wallet | — | 1.00 |
| bc1q8y9wc2p9444y8r77xtmswxm9qqw90nrpufkx47 | FBI-attributed DPRK / Lazarus Group laundering wallet | — | 1.00 |
| bc1qlq3s8hgczfe62yt94xqasdr5ftuuyrc5kgvpwr | FBI-attributed DPRK / Lazarus Group laundering wallet | — | 1.00 |
| bc1q82gvk20m08uctmmr97p2mqyxtyh6xf68rwe0t9 | FBI-attributed DPRK / Lazarus Group laundering wallet | — | 1.00 |
| bc1qrqv5f7jxhp67jcgk9wv5jx4795wlntvhdz2a7j | FBI-attributed DPRK / Lazarus Group laundering wallet | — | 1.00 |
| bc1qkrkxgvp2te3xhgn74c2azt4flf9u05y56kh3a9 | FBI-attributed DPRK / Lazarus Group laundering wallet | — | 1.00 |
See how this source overlaps with the others
The cross-source view shows every address labelled by two or more of our 15 sources — useful when one source flags an address and you want to know who else has it tagged, and how.
Cross-source overlapWant this as a feed?
Same data drives the Address Monitoring API: real-time inflow / outflow events on these addresses as they confirm.
About the API