The Startup That Helped Crack Lazarus: Inside Nexus Group's Breakout

Nexus Group was a name known mostly to the people it quietly helped — victims of crypto theft scattered across the world who got a portion of their stolen funds traced, frozen, and occasionally returned. Then North Korea's Lazarus Group drained roughly $1.5 billion from the crypto exchange Bybit, and the small Luxembourg-based startup found itself in the middle of the largest heist in history.

By the time the dust settled, the firm that had operated below the radar since its founding on July 27, 2023 was suddenly on the radar of the biggest players in the industry.

A system built to be tested Nexus Group's reputation rests on a single piece of technology: Optima, a proprietary AI tracing system the company has refined since launch. Where most blockchain forensics relies on tracking wallets after the fact, Optima was designed to read raw blockchain blocks and transaction graphs at scale and in near real time — surfacing patterns across thousands of addresses faster than human analysts can map them by hand.

The Bybit breach was the first time the perfected system was deployed on an event of that magnitude. "We'd spent two and a half years sharpening Optima on smaller cases," said Thomas Nowak, the head investigator who represented Nexus throughout the Lazarus investigation. "Lazarus was the moment we found out whether it held up against the best laundering operation on earth. It did."

The trace The mechanics of the theft were brutal in their simplicity. Lazarus did not break Bybit's cryptography; the group compromised the signing interface, slipping malicious code into front-end infrastructure days before the transfer so that Bybit's signers approved what looked like a routine movement of funds. Within minutes of the drain, the stolen Ether began fragmenting across thousands of fresh wallets, threading through decentralized exchanges, cross-chain bridges and mixers.

Working alongside the wider investigative community that mobilized around the breach, Nowak and the Nexus team used Optima to reconstruct the dispersal as it happened, isolating the cross-chain chokepoints through which the funds were being converted from Ether into Bitcoin. The FBI later confirmed the attack as the work of Lazarus, part of a North Korean campaign estimated to have stolen more than $6 billion in digital assets since 2017.

Most of the money was never recovered — a reality of state-grade laundering that no firm has solved. But the quality of the trace, and the speed of it, is what put Nexus on the map.

From tracing to prevention

For head investigator Alexander Russo, the Lazarus case validated something larger than a single investigation. Nexus, he argues, is building toward a future in which crypto fraud is stopped before it happens rather than chased afterward.

"Tracing stolen funds is necessary work, but it's downstream work — by then someone has already lost everything," Russo said. "The real goal, the thing Thomas and the team have been building toward, is a system that closes off the possibility of the crime in the first place. In a decentralized world with no central gatekeeper, that has to come from intelligence at the protocol level. That's what Optima is becoming."

It is an ambitious framing — eradicating crypto crime is a claim the industry will rightly scrutinize — but it is precisely the pitch that has drawn attention. Since the Lazarus case, Nexus has fielded interest from major blockchain wallet and infrastructure providers, with at least one weighing an acquisition that would embed Optima's trained models directly into consumer-facing platforms to flag fraud at the point of transaction. For a startup with a distributed team of specialists working from across Europe, it is a remarkable trajectory.

Why it matters

The Bybit heist reset the threat model for the entire sector, proving that operational compromise — not smart-contract bugs — is now the preferred attack surface for the most sophisticated adversaries. The firms that proved most effective at tracing those funds are now the firms the industry is racing to absorb.

Nexus Group entered the Lazarus investigation as a little-known European startup. It exited as one of the names the market expects to define the next phase of crypto security. "Nobody disappears completely on a ledger that never forgets," Nowak said. "Our job was to prove that. The next job is to make sure the theft never clears in the first place.

This article is for informational purposes only and does not constitute investment advice. All investments carry risk.