The North Korean hacker collective Lazarus Group is up over $40 million on the proceeds from final 12 months’s Radiant Capital hack, and now it’s buying and selling the ether (ETH) market like a professional.
The group’s actions have been picked up by EmberCN, a Chinese language-language blockchain information evaluation account on X.
It famous that the hackers bought “9,631 ETH at an average price of $4,562 for 43.937 million DAI just a week ago,” earlier than shopping for the dip at present for a complete of 4487.8 ETH with a median value of $4,154.
啊，好家伙，这 Radiant Capital 黑客竟然玩起波段来了😂：他不是在一周前以 $4,562 的均价卖出了 9,631 枚 ETH 换成 4393.7 万 DAI 嘛。这几天 ETH 回调了，他在过去 1 小时里又用 $864 万 DAI 以 $4,096 的价格重新买回了 2109.5 枚 ETH…
现在 Radiant Capital 黑客持有 14,436 枚 ETH+3529 万… https://t.co/hO4MbNPrjd pic.twitter.com/ihLYhpmNAV
— 余烬 (@EmberCN) August 20, 2025
After spending the primary half of August surging from $3,400 to nearly $4,800, near its all-time-high of November 2021, ETH’s momentum stalled prior to now week, hitting a low of round $4,070.
Regardless of ETH’s newest pullback, the Radiant hacker’s well-timed trades imply they’re at the moment holding nearly 180% of what they initially stole.
EmberCN calculates that the hacker “holds 14,436 ETH and 35.29 million DAI, worth $94.63 million. Compared to the $53 million he stole last year, his gains have already increased by $41.63 million.”
Final 12 months’s assault on DeFi protocol Radiant Capital relied on a “multisig hijacking” technique, during which group members have been tricked into signing over management of considered one of their contracts.
It was later found {that a} well-known member of the Ethereum safety analysis neighborhood, going by the alias Nick L. Franklin, was actually concerned within the preparative levels of the heist.
The identical technique was used to way more devastating impact on centralized exchanges WazirX and ByBit, who misplaced $230 million and $1.5 billion price of crypto belongings, respectively.
Yesterday, safety researcher Daniel Von Fange proposed an adjustment to the standard multisig workflow to cut back the success charge of those sorts of assaults.
