North Korea-linked Lazarus Group has transferred 244.148 Bitcoin worth about $19.42 million, bringing fresh attention to wallets associated with one of the crypto industry’s most active hacking operations.

Lazarus Group moves 244 BTC between wallets

Lookonchain reported the transfer in an Aug. 28 X post, saying wallets attributed to Lazarus Group had become active again and moved 244.148 BTC about an hour before its alert.

Bitcoin traded at roughly $79,500 when the analytics account published its estimate, placing the transaction’s value at $19.42 million. Lookonchain did not identify the receiving address in the text of the post or say whether the Bitcoin moved to an exchange, mixer, or another wallet controlled by the group.

Without a disclosed destination, the transaction alone does not show that Lazarus sold or attempted to cash out the Bitcoin. Public blockchain records confirm when funds move between addresses, but connecting those addresses to an organization usually depends on labels and analysis supplied by investigators or blockchain intelligence firms.

The Aug. 28 transaction followed another large Bitcoin movement attributed to the group earlier in the month. On Aug. 12, Lookonchain said Lazarus transferred 262.2 BTC, then valued at approximately $16.64 million, from an identified wallet to a newly created address.

At the time, the analytics account described the transaction as a wallet-to-wallet transfer rather than a sale. Taken at their reported dollar values, the two August movements involved more than $36 million in Bitcoin, though no source has confirmed that the transactions came from the same balance or served the same purpose.

Past wallet activity shows why the destination matters. In March 2025, five unknown addresses received a combined 44.07 BTC worth about $3.76 million from wallets attributed to Lazarus, according to earlier on-chain reporting. The transactions reduced the tracked wallet’s holdings to 13,441 BTC at the time.

Bybit theft left Bitcoin across thousands of addresses

As crypto.news previously reported, Bybit sued North Korea and Lazarus Group in a Washington, D.C., federal court on Aug. 7, seeking to recover assets tied to the exchange’s $1.5 billion theft.

The lawsuit also named North Korea’s Reconnaissance General Bureau, or RGB, which the U.S. Treasury identifies as the country’s main intelligence agency. A federal judge issued a preliminary injunction that blocked unidentified defendants from transferring, selling, or disposing of certain assets connected to the case.

Bybit filed the civil action separately from ongoing U.S. criminal investigations. A preliminary injunction preserves the identified property while litigation continues and does not amount to a final decision on ownership or liability.

The FBI attributed the February 2025 Bybit attack to North Korean actors operating under the TraderTraitor name. According to the agency, the attackers converted part of the stolen holdings into Bitcoin and other assets before spreading them across thousands of addresses on several blockchains.

In its public alert, the FBI said it expected the assets to be moved again and eventually exchanged for government-issued currency. The bureau asked exchanges, bridges, decentralized finance services, blockchain analytics companies, and node operators to block transactions involving the addresses it identified.

By April 2025, Bybit CEO Ben Zhou said 27.6% of the stolen funds could no longer be tracked, according to an August report on North Korea’s attack methods. The same report said the distribution of assets across many Bitcoin wallets had made blockchain tracing more difficult.

Lookonchain has not connected the latest 244.148 BTC transfer directly to the Bybit theft. No government agency or blockchain intelligence company cited in the available reporting has publicly identified the source of the coins involved in the Aug. 28 movement.

Lazarus-linked attacks continued into 2026

Chainalysis estimated that North Korean hackers stole at least $2.02 billion in cryptocurrency during 2025, an increase of 51% from the previous year. The firm placed the country’s cumulative crypto theft at no less than $6.75 billion by the end of that period.

According to its December 2025 report, North Korean operations accounted for 76% of the value lost through attacks on crypto services during the year. Chainalysis said the attackers carried out fewer confirmed incidents but extracted larger amounts from successful breaches.

The firm also found that North Korean operators had increasingly targeted companies through impersonation and employee access. Some actors posed as job applicants to enter crypto businesses, while others pretended to recruit for known Web3 and artificial intelligence companies, according to Chainalysis.

Activity attributed to Lazarus continued in April 2026 when attackers drained approximately 116,500 rsETH, worth about $292 million, from KelpDAO’s LayerZero-based bridge. LayerZero attributed the attack with preliminary confidence to Lazarus Group’s TraderTraitor unit.

Chainalysis later said the attackers compromised infrastructure that supplied blockchain information to LayerZero’s verification system. By feeding false data to the system, they caused an Ethereum contract to release assets even though no matching token burn had occurred on the source network.

Rapid intervention blocked a second attempted theft worth about $95 million, according to Chainalysis. The Arbitrum Security Council also froze more than 30,000 ETH that investigators connected to the attacker’s downstream transactions.

By June, the KelpDAO attacker had moved approximately $220 million in unfrozen assets through privacy services, according to subsequent tracking data. The routes included THORChain, Wasabi, Tornado Cash, and Umbra, while around $1.7 million remained in the original wallets.

U.S. sanctions restrict dealings with Lazarus Group

The U.S. Treasury’s Office of Foreign Assets Control sanctioned Lazarus Group in September 2019 under an executive order targeting the North Korean government. OFAC identified Lazarus, Bluenoroff, and Andariel as state-controlled hacking groups connected to the RGB.

Under the designation, property belonging to Lazarus that enters the United States or comes under the possession or control of a U.S. person must be blocked and reported to OFAC. Treasury regulations also generally prohibit Americans from conducting transactions with sanctioned entities unless the agency authorizes them.

Treasury said Lazarus had targeted governments, financial institutions, media companies, manufacturers, infrastructure operators and cryptocurrency businesses through cyber theft, espionage and malware attacks. The department linked the group to the 2014 Sony Pictures breach and the WannaCry ransomware attack that affected computers across at least 150 countries.

U.S. authorities have also acted against services used to process funds tied to the group. In 2022, the Treasury sanctioned the virtual currency mixer Blender.io after saying it had handled more than $20.5 million from the roughly $620 million Ronin Network theft. The FBI later attributed the Ronin attack to Lazarus Group and APT38.

In August 2023, the FBI separately warned crypto companies about movements involving Bitcoin stolen by North Korean TraderTraitor actors. The agency said the group could attempt to cash out more than $40 million in Bitcoin and published six wallet addresses for private companies to examine.

Solana validators have approved a change to the network’s token supply schedule that accelerates how quickly inflation is reduced. In finalized governance results, the “Double Disinflation” proposal (SGP-0002) won 67% support, with 25.16% voting against and 7.84% abstaining, based on the participation of 60.7% of eligible stake.

The decision increases Solana’s annual disinflation rate from 15% to 30% while keeping the network’s long-term inflation target at 1.5% unchanged. That adjustment is expected to shorten the time to reach “terminal inflation” from about 5.7 years to roughly 2.8 years, according to Solana Compass reporting.

Key takeaways

• SGP-0002 passes: 67% of voting stake supported doubling Solana’s disinflation rate to 30%.
• Participation matters: 60.7% of eligible stake voted, setting the approval turnout for the first binding governance cycle.
• Terminal inflation arrives sooner: Solana Compass estimates ~2.8 years versus ~5.7 years under the prior schedule.
• Lower projected issuance: The change implies about 18.9 million fewer SOL to be issued over the next six years.
• Trade-offs for staking: Faster supply reduction may also reduce staking rewards for validators and delegators compared with the earlier plan.

What validators approved and what it changes

The approved proposal, identified as SGP-0002 (“Double Disinflation”), modifies how Solana reduces inflation over time. Per the finalized vote results published on Solana’s governance portal, the annual disinflation rate is set to rise from 15% to 30%, with Solana’s long-term inflation target remaining at 1.5%.

Practically, that means the network expects to reach its terminal inflation rate considerably faster. Solana Compass reported that the new schedule would bring the 1.5% target in about 2.8 years rather than the previously estimated ~5.7 years.

Impact on issuance, dilution, and staking economics

Supply changes tend to reshape incentives across the ecosystem, and SGP-0002 is no exception. Along with the timing shift, the proposal is expected to reduce future SOL issuance. The article’s figures cite an estimate of 18.9 million fewer SOL issued over the next six years, which would lower dilution pressure for existing holders.

At the same time, faster disinflation can also change the staking payoff profile. The updated approach is expected to reduce staking rewards for validators and delegators relative to what the slower schedule would have produced—an important consideration for participants who rely on rewards as part of their broader returns.

First binding governance cycle: Constitution passes, other fee proposal rejected

SGP-0002 was voted on as part of Solana’s first binding governance process. Alongside the supply change, the process also approved a proposed Solana Constitution, while rejecting a separate proposal related to resource and inclusion fees.

This broader package matters because it shows how Solana’s governance framework is being tested not only on monetary policy, but also on the rules that shape how future decisions are made and how the network structures certain operational costs.

Major voters were split—Kraken’s position shifted during the vote

Finalized governance data show that even large participants did not uniformly align behind the supply change. Figment—reported as the largest voter shown in the finalized dataset with 17.1 million SOL staked—voted entirely against SGP-0002, while other major stakeholders such as Helius and Jupiter overwhelmingly supported the measure.

Another notable development was Kraken’s changing stance. Solana Compass reported that Kraken initially voted against SGP-0002 at 12:33 UTC, which temporarily pushed support below the required threshold. By the end of voting, more than 90% of Kraken’s roughly 8.9 million SOL voting stake backed the proposal.

For investors and delegators, these splits highlight a key dynamic: while the final outcome was clear, major market participants evaluated the supply schedule trade-offs differently during the process.

Governance decision arrives alongside ETF momentum

Solana’s governance vote also landed as US-listed Solana investment products continue to pull in capital. According to an X post by Bloomberg ETF analyst Eric Balchunas, Bitwise’s Solana ETF recently surpassed $1 billion in assets, becoming the first Solana ETF to reach that milestone.

The post also claimed that US Solana ETFs have accumulated roughly $1.7 billion in cumulative net inflows, with little sustained outflow since launch, even as SOL’s performance earlier in the year lagged relative to broader expectations.

While ETF flows are not directly tied to validator voting, both developments reflect the same underlying question for Solana: how governance outcomes around monetary policy can influence long-term holder incentives at the same time that traditional investment access expands.

Next, market participants will likely watch how the faster path to 1.5% terminal inflation affects staking yields and validator incentives over time, and whether future governance proposals continue to settle contentious economic questions with similar turnout and stakeholder alignment.

Solana validators have approved a proposal to double the network’s annual disinflation rate, reducing future SOL issuance.

According to finalized voting results, the proposal received 67% support, with 25.16% voting against and 7.84% abstaining. Overall participation reached 60.7% of eligible stake.

The proposal, known as SGP-0002 or Double Disinflation, increases Solana’s annual disinflation rate from 15% to 30%, while leaving the network’s long-term inflation target of 1.5% unchanged.

Under the new schedule, Solana is expected to reach its 1.5% terminal inflation rate in about 2.8 years, compared with roughly 5.7 years under the previous schedule, Solana Compass reported. The change would result in an estimated 18.9 million fewer SOL being issued over the next six years, reducing dilution for SOL holders but also lowering staking rewards for validators and delegators.

SGP-0002 passed with 67% support and 60.7% participation. Source: Solana Governance

The vote was part of Solana’s first binding governance process, which also approved a proposed Solana Constitution while rejecting a separate proposal on resource and inclusion fees.

Some of the largest participants were divided over SGP-0002. Figment, the largest voter shown in finalized governance data with 17.1 million SOL staked, voted entirely against the measure, while Helius and Jupiter overwhelmingly backed it.

Kraken was among those whose position shifted during the vote. The US-based crypto exchange initially voted against SGP-0002 at 12:33 UTC, temporarily pushing support below the required threshold. By the end of voting, more than 90% of its roughly 8.9 million SOL voting stake backed the proposal.

Top voters were split on SGP-0002. Source: Solana Governance

Related: Solana transactions hit record 4.2B as SOL rallies 40%

Solana ETF assets cross $1 billion

The governance vote comes as US-listed Solana investment products continue to attract investor capital despite SOL’s weaker performance earlier this year.

Bitwise’s Solana ETF recently surpassed $1 billion in assets, becoming the first Solana ETF to reach the milestone, according to an X post from Bloomberg ETF analyst Eric Balchunas on Friday.

US Solana ETFs have attracted roughly $1.7 billion in cumulative net inflows, with little sustained outflow since their launch, Balchunas said Friday.

Source: Eric Balchunas

Magazine: Hugging Face hack exposes the open-weight AI cybersecurity paradox

Bitcoin reclaimed levels above $80,000, pulling a wave of momentum through crypto equities and the broader digital-asset “plumbing” that links token demand to traditional finance. The rally has coincided with expectations around US long-dated Treasury bond buybacks and renewed political pressure for clearer US crypto regulation, helping lift miners, exchanges, and stablecoin-linked businesses.

At the same time, the market’s focus is narrowing onto how access to dollar-based capital markets and payment rails translates into real onchain activity and institutional balance sheets. From Circle’s USDC growth thesis to Strategy’s debt-servicing risk framework and Solana’s record throughput, this week’s developments underline a common theme: crypto performance is increasingly tied to traditional liquidity conditions and regulated financial infrastructure.

Key takeaways

• Bitcoin trading above $80,000 lifted crypto stocks, with miners and digital asset treasury firms posting double-digit gains as broader risk appetite improved.
• Bernstein says Circle’s USDC supply growth resumed after a six-month slowdown, pointing to a potential “next leg” driven by tokenized capital markets and payments adoption.
• Regime Intelligence frames Strategy’s main vulnerability as financing access rather than a BTC price collapse, emphasizing the ability to service annual obligations.
• Solana recorded a new high of 4.2 billion onchain transactions in July, supported by a concurrent 40% price move and accelerating real-world asset (RWA) tokenization activity.

Bitcoin’s rebound pulls crypto stocks higher

Bitcoin’s move back above $80,000 helped drive gains across public crypto markets. According to Cointelegraph Markets coverage, the week’s advance lifted miners and digital asset treasury companies, while broader sentiment tracked with expectations around the US Treasury’s plan to double certain long-dated bond buybacks.

Over the past week, Canaan, MARA Holdings, and Strive were cited among the biggest gainers. Coinbase and Robinhood also rallied as the recovery extended. CoinMarketCap data cited in the original reporting showed Bitcoin pushing its weekly advance beyond 23%, while Ether rose nearly 30% to trade above $2,500.

On the policy front, President Trump renewed calls for Congress to pass the CLARITY Act, though the bill remained stalled after lawmakers failed to move it forward before the August recess. The bill’s potential impact—clearer rules for US crypto markets—remains a key variable for long-term institutional participation. Trump also revived the idea of government Bitcoin purchases, but neither scenario is guaranteed.

For investors, the market’s reaction suggests that timing matters: risk-on conditions can quickly reprice shares tied to crypto asset exposure, even before regulatory clarity arrives. What remains important is whether the rally can persist without a further improvement in capital-market liquidity.

Bernstein renews its USDC growth cycle outlook for Circle

Circle has also come under fresh analyst attention, with Bernstein arguing that USDC could enter a renewed growth phase over the next 12 months as stablecoin supply growth picks up again.

In a Monday research note, Bernstein said USDC supply increased by roughly $2 billion in seven days, ending a six-month stretch of stagnant or declining growth. The firm maintained an Outperform rating on Circle and a $140 price target—an outlook that implies around 60% upside based on the assumptions in its coverage. The original report also noted that Circle’s shares had risen about 40% over the past month.

Bernstein’s thesis ties the next stage of USDC growth to several connected catalysts: renewed crypto momentum, improving US regulatory clarity, and broader adoption of tokenized capital markets and payments. The firm also pointed to early signs of demand from AI agents, though the underlying data for that claim was not detailed in the source.

One specific metric cited in the report—USDC’s share of adjusted transaction volume—helps explain the argument’s direction. Bernstein reported that USDC’s share rose from roughly 40% in 2025 to over 60% so far in 2026, overtaking Tether’s USDt on that measure. In a competitive stablecoin market, share of transaction volume can matter as much as raw supply growth because it reflects which asset is being used as the settlement layer in active flows.

The analyst backdrop is complicated by Circle’s own trading history since its June 2025 IPO, when shares were priced at $31. After an early post-IPO surge, the stock fell back toward that level by November 2025 as crypto markets entered a downturn—an episode that underscores how sensitive even “infrastructure” narratives can be to risk cycles.

Strategy’s key risk: capital market access, not a BTC price wipeout

While much of crypto reporting focuses on Bitcoin’s price path, a Regime Intelligence report highlighted a different risk channel for Strategy: the threat is not necessarily that BTC collapses, but that the company loses access to capital markets needed to service its obligations.

According to the original report, Strategy’s vulnerability centers on its ability to meet annual obligations of $1.76 billion without having to sell BTC, which is structurally relevant because Strategy’s balance sheet and financing model depend on continued funding conditions. The company holds 840,447 BTC backing $22 billion in debt and preferred claims, and the report stated there are no margin calls tied directly to Bitcoin’s price.

The stress-test framing is also notable. The cited analysis says Bitcoin would need to fall 96% for Strategy’s holdings to no longer cover its convertible notes, suggesting a wide buffer against a severe but not “catastrophic” drawdown. The report further said Strategy holds cash reserves equal to 2.6 times its annual obligations, and that its BTC holdings were worth $66.7 billion versus a cost basis of $63.36 billion.

Komodo Platform co-founder Kadan Stadelmann told Cointelegraph that even if equities unraveled, Strategy’s BTC holdings would put it in a relatively strong position to weather most scenarios—because the company holds far more Bitcoin than its annual cash obligations.

However, the risk is more about financing than mark-to-market. The report’s logic suggests that if financing conditions worsen—especially alongside a declining Strategy share price and lower mNAV—raising fresh capital could become harder. In that situation, Strategy might have to draw down reserves or sell BTC to maintain its operating structure.

Stadelmann emphasized that Strategy’s weakness lies in the need to issue capital to service its structure, adding that if equity markets collapse, the company could end up parting with Bitcoin as part of its operating needs. The original reporting also noted Strategy has sold BTC four times since May, while CEO Phong Le said the company accumulated 25 times more BTC over the same period and plans to resume purchases.

For readers, the practical takeaway is that “survivability” in institutional Bitcoin plays can be disconnected from short-term BTC volatility. Liquidity access can become the binding constraint even when downside math looks survivable.

Solana hits record throughput as RWA tokenization grows

On the network side, Solana’s activity surged alongside price. The original report said Solana processed a record 4.2 billion onchain transactions in July, preceding a 40% rally that pushed SOL above $100 for the first time since February.

The transaction data was attributed to onchain figures presented by The Kobeissi Letter. In the same coverage, activity was described as rising 13.5% from June and 91% from December—adding roughly 2 billion transactions over that span. Record throughput matters because it can signal that demand isn’t limited to a single category of applications; instead, it suggests broader usage that can translate into ecosystem fees and more robust onchain settlement.

Tokenization is a key part of that broader narrative. The Kobeissi Letter also cited RWA.xyz data indicating that nearly $4 billion worth of real-world assets are tokenized on Solana, up 11.8% over the past month. Across tracked networks, distributed RWAs were reported to have surpassed $38 billion.

The rally in SOL was also linked to macro conditions. The original article connected Solana’s upward move to a US Treasury Department announcement about doubling certain long-dated bond buybacks to at least $4 billion per operation, which was described as helping push yields lower and improve risk appetite. Still, the report cautioned that continued gains depend on ongoing network activity and further RWA adoption, not just a temporary macro tailwind.

Investors watching Solana may want to monitor whether transaction growth sustains after the initial repricing of risk assets, and whether RWA tokenization continues to scale into a deeper base of recurring usage rather than remaining concentrated in early categories.

Going forward, the market will likely keep oscillating between two drivers: traditional liquidity signals (such as Treasury buyback expectations) and crypto-specific infrastructure metrics (stablecoin usage shares, onchain transaction throughput, and institutional financing access). The next question is whether this week’s rebound turns into a durable shift—or fades if capital-market conditions tighten again.