source_3799.pdf (10 MB)

SlowMist’s mid-year 2026 blockchain security and AML report names Lazarus Group as a North Korean state-sponsored actor that remained active in cryptocurrency attacks. The DPRK-focused section says Lazarus used supply chain compromise, social engineering, DeFi protocol attacks, cross-chain infrastructure exploitation, and money laundering to support an end-to-end intrusion, theft, and laundering chain. SlowMist highlights the group’s use of privacy protocols, cross-chain bridges, DeFi lending platforms, and cryptocurrency mixers to create layered fund-transfer networks that increase stealth and complicate tracing. The broader report also records 182 blockchain security incidents and about USD 956 million in H1 2026 losses, with supply chain attacks causing the largest losses by value.