Chainabuse records Lazarus Group moving 41,000 ETH from the Harmony Bridge theft through Railgun on January 13–14, 2023 before depositing funds at three exchanges. The source is primarily an abuse report with a large wallet list, but its core CTI value is the attribution of post-theft laundering activity to Lazarus and the movement pattern through a privacy service. Analysts tracking DPRK cryptocurrency theft can use the report as evidence of the group’s continued attempts to obfuscate and cash out stolen bridge funds.