Sanctions list
FBI-published Lazarus Group crypto addresses
In September 2023 the FBI publicly attributed the $41 million Stake.com theft to North Korea's Lazarus Group and published the addresses holding the stolen funds. CompliAPI screens against those addresses verbatim.
- Publisher
- US Federal Bureau of Investigation
- List type
- Sanctions
- Refresh
- Static list, reconciled daily
- API list slug
us_fbi_lazarus_crypto- Official source
- FBI press release, September 6, 2023
About this list
The Lazarus Group (also tracked as APT38) is a North Korean state-sponsored hacking group and a US-designated entity, responsible for some of the largest cryptocurrency thefts on record. Law enforcement occasionally publishes the specific wallet addresses it attributes to the group — actionable data that can precede formal list updates.
This source is the FBI's September 6, 2023 press release identifying Lazarus Group actors as responsible for the theft of roughly $41 million from the online casino Stake.com, which named the Ethereum addresses holding the stolen funds.
CompliAPI transcribed the addresses verbatim from the release — a US government work in the public domain — and every match links back to it. The list is static: it changes only if the FBI amends the underlying release.
What CompliAPI extracts
- Ethereum wallet addresses attributed to the Lazarus Group
How CompliAPI handles it
Transcribed from the official release
The addresses come directly from the FBI press release, with the publication date and source link stored on every record.
Reconciled daily
Although the list is static, it participates in the same daily reconciliation as every fetched list, so its rows stay consistent with the shared audit model.
Checked on every crypto screen
Addresses on this list are checked by default whenever /screen/crypto runs, alongside the other enabled lists — no separate endpoint needed.
Screen against this list
Every /screen endpoint checks all enabled lists by default and names the list behind each match. Add the ?lists= filter to restrict a request to this source.
GET /api/v1/screen/crypto/{address}?lists=us_fbi_lazarus_crypto
curl "https://api.compliapi.com/api/v1/screen/crypto/0x94f1b9b64e2932f6a2db338f616844400cd58e8a?lists=us_fbi_lazarus_crypto" \
-H "Authorization: Bearer $COMPLIAPI_TOKEN"Response
{
"value": "0x94f1b9b64e2932f6a2db338f616844400cd58e8a",
"flagged": true,
"sanctioned": true,
"lists_checked": ["us_fbi_lazarus_crypto"],
"matches": [
{
"list": "us_fbi_lazarus_crypto",
"list_name": "FBI Lazarus Group crypto addresses",
"list_type": "sanctions",
"match": "exact",
"value": "0x94f1b9b64e2932f6a2db338f616844400cd58e8a",
"source_url": "https://www.fbi.gov/news/press-releases/fbi-identifies-lazarus-group-cyber-actors-as-responsible-for-theft-of-41-million-from-stakecom"
}
]
}Frequently asked questions
Where do these Lazarus Group addresses come from?
From the FBI's September 6, 2023 press release attributing the $41 million Stake.com theft to the Lazarus Group. The addresses were transcribed verbatim from that release, which every match links back to.
Why does an FBI press release count as sanctions data here?
The Lazarus Group is a US-designated entity, and these addresses are the FBI's official attribution to it. CompliAPI classifies the list as sanctions data, so a match sets sanctioned: true — and the source link lets your reviewers weigh the underlying attribution themselves.
Does the FBI Lazarus list ever change?
It is static by design: the addresses mirror the press release exactly and would change only if the FBI amended it. New law-enforcement address publications would arrive as new curated sources rather than edits to this one.
Do I need to query this list separately?
No. Every /screen/crypto request checks it by default along with the other enabled lists; ?lists=us_fbi_lazarus_crypto restricts a check to it if you want that.
Related
Sanctions list
The US OFAC SDN list
How CompliAPI ingests the US Treasury OFAC SDN list: crypto addresses, emails, websites and government IDs extracted every 15 minutes, with delistings tracked and the official record linked on every match.
Sanctions list
NBCTF Israel: the crypto seizures list
Israel's National Bureau for Counter Terror Financing (NBCTF) crypto seizure orders as a clean dataset — searchable, with CSV download and API access.
Risk exposure
Tornado Cash association lists
How CompliAPI builds its Tornado Cash lists: a daily crawl of the mixer's Ethereum pool events records depositors and relayers, with the evidencing transaction on every hit.
Sanctions screening
Wallet screening API for crypto compliance
Screen crypto wallets against OFAC and global sanctions lists in one GET request.
Screen against FBI Lazarus Group data
Get a free API key and make your first request in minutes — every screen checks all enabled lists in one call.
14-day free trial. No credit card required.
CompliAPI provides data and tools that support compliance workflows. It does not provide legal advice, and organizations should determine their obligations with qualified counsel.