Lazarus hackers cripple UK crypto platform Lykke, costing £17 million

Lykke's Demise: Lazarus's Shadow Falls on UK Crypto Platform

The once-promising British cryptocurrency platform, Lykke, has been forced to shutter its operations, a devastating blow attributed to a sophisticated cyberattack orchestrated by the notorious North Korean hacking collective, Lazarus. The financial fallout is staggering, with the company reportedly losing a colossal £17 million (approximately $23 million) in digital assets. This incident serves as a stark reminder of the persistent and evolving threats lurking in the digital realm of decentralized finance.

The Trail of Destruction: Lazarus's Signature Move

The fingerprint of the Lazarus group, a cyber espionage and financial theft unit with alleged ties to the North Korean government, is strongly suspected to be behind the breach. This formidable entity has a well-documented history of audacious cyber heists targeting financial institutions and cryptocurrency exchanges worldwide. The attack specifically targeted Lykke's reserves of Bitcoin, Ethereum, and various other cryptocurrencies, draining its coffers and plunging it into an unrecoverable crisis.

From Swiss Roots to UK Registration: A Fragile Empire

Founded in 2015, Lykke operated with a global perspective, conducting its business from Switzerland while maintaining its official registration in the United Kingdom. This international structure, while common in the tech world, perhaps offered a complex web that the attackers skillfully navigated. The immediate aftermath of the hack saw Lykke forced to freeze all trading activities, a desperate measure to stem further losses. Ultimately, the company made the agonizing announcement of its closure in December of the previous year.

Justice Pursues the Digital Ghosts

The repercussions of this devastating attack have extended beyond the company's demise. In March 2025, a British judge officially ordered the liquidation of Lykke following a wave of legal actions initiated by over 70 distressed users. These individuals, having lost millions in their digital holdings, sought redress and the return of their desperately needed funds. The UK's Treasury Department, through its Office of Financial Sanctions Implementation (OFSI), has officially attributed the attack to cyber actors associated with the Democratic People's Republic of Korea (DPRK), solidifying the international condemnation of North Korea's alleged cyber activities.

Beyond Direct Theft: Lazarus's Multifaceted Tactics

This incident underscores that the Lazarus group's modus operandi is far from monolithic. While direct cryptocurrency theft is a brutal hallmark, their tactics are increasingly sophisticated and insidious. Reports suggest they also employ advanced strategies, including leveraging AI-powered deepfakes to impersonate individuals and infiltrate companies by posing as legitimate job applicants. Furthermore, they are known to bait unsuspecting developers with enticing yet fraudulent job openings, a testament to their adaptive and relentless pursuit of ill-gotten gains. The Israeli cryptocurrency intelligence firm, Whitestream, has also corroborated the link between the Lykke hack and the Lazarus group, adding further weight to the investigative findings. The stolen funds, a substantial sum, were subsequently laundered through two other cryptocurrency firms, a common practice designed to obscure the trail of illicit money.