Cyber Hack · BBC World Service

The Lazarus Heist S2: Special: The biggest heist yet

August 18, 2025·56 min·5 clips

A CEO's routine transfer of $100 million in Ethereum triggers a phone call revealing a $1.5 billion hack.

The job looks ordinary at first. A CEO is working late, moving cryptocurrency from a secure offline vault into an internet-facing one so business can keep running. The amount changes the mood fast: 30,000 Ethereum, described as worth more than 100 million US dollars. Multiple people have to approve it. The CEO and his team check the destination, click the buttons, and the task seems done. It is Friday night, so he moves on. Half an hour later, everything looks different. The episode moves from one transaction into the messy machinery that helps stolen cryptocurrency hide in plain sight. Nick enters the story here. He learned Korean in the US Army, was deployed to the Korean DMZ, then spent 12 years at the FBI tracking North Korean sanctions avoidance. Now he works at TRM Labs. His reason for getting into crypto is simple: North Korea was stealing it, so someone had to follow the trail. In theory, the tracking sounds clean. Each fragment can leave a digital signature, like pulverised colored dust still carrying a thread back to where it came from. In practice, scale gets ugly. One thread can be followed. Thousands can bury an investigation. The hackers still need usable money, too. Cryptocurrency does not easily buy the real-world goods the regime needs, including fuel oil or weapons-program components. That is where brokers matter. The laundering is not only technical cover. It creates distance before stolen assets are sold for dollars, Chinese yuan, or other money that can actually be spent. A broker becomes the missing human link: the bridge between digital loot and real purchasing power.

As heard by us

A clean account of how stolen crypto moves from vault to broker to real money.

This episode starts with a late-night crypto transfer that looks routine, then shifts when a phone call changes the mood and opens the door to North Korea's theft-and-laundering machinery.

Read the full review in PlayNext →

Why you'd press play

Follow one routine vault transfer as it turns into a North Korea-linked crypto heist.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Cyber Hack