Chainalysis analyzed Lazarus Group cryptocurrency theft and laundering behavior in 2019, noting greater use of mixers and CoinJoin wallets to obscure stolen funds. The report describes the DragonEx intrusion as an unusually elaborate phishing operation in which Lazarus built a fake company, Worldbit-bot, to impersonate a legitimate automated trading platform. Lazarus used social engineering to persuade exchange employees to install malicious software and gain access to funds. The case illustrates both the group’s operational investment in cryptocurrency theft and its evolving laundering tradecraft after exchange compromises.