Cyber threats / Incident register

Lazarus Group Cryptocurrency Exchange Heist — Singapore

APT activity · Apr 28, 2026
Critical STIX 2.1 MISP
Summary

Lazarus Group (DPRK) executed a sophisticated supply-chain compromise of a cryptocurrency custodial platform based in Singapore, stealing approximately USD 230 million in mixed crypto assets. The attack chain involved compromising a third-party trading SDK used by the exchange, injecting malicious transaction-signing code. FBI and MAS (Monetary Authority of Singapore) issued joint alert. Funds traced through Tornado Cash and cross-chain bridges to DPRK-linked wallets.

Sources
Attribution
Lazarus Group (DPRK RGB)
Where
SG SingaporeKR South KoreaJP Japan
Sectors: Financial Services, Cryptocurrency
EU relevance
High
Attributed to Lazarus Group: EU cyber sanctions since July 2020 (WannaCry)
Graded by rules: EU member states affected, EU response, EU sanctions, EU projects in the sector hit.