Elliptic describes how sanctioned North Korea-linked actors, including Lazarus Group and facilitators sanctioned for supporting it, move stolen cryptocurrency through multiple intermediary wallets to obscure exposure. The report highlights Lazarus laundering after the June 2018 Bithumb theft, where funds passed through dozens of wallets before reaching the Russia-based YoBit exchange. It also cites cross-asset and DeFi laundering patterns, warning that exchanges can miss sanctions exposure if screening stops after only a few hops.