Lazarus Group Behind Bybit’s $1.4 Billion Hack: Reports

Key Points:

  • Security researchers linked North Korea’s Lazarus Group to a record $1.4 billion breach of crypto exchange Bybit.
  • Hackers drained 70% of Bybit’s Ether holdings (401,000 ETH), with Bybit securing a bridge loan to cover 80% of the stolen funds.
Lazarus Group Behind Bybit's $1.4 Billion Hack: Reports

Security researchers have linked the North Korean Lazarus Group to a record-breaking $1.4 billion breach of cryptocurrency exchange Bybit, marking one of the largest crypto heists in history.

The Bybit breach not only set a record for the scale of damage in the cryptocurrency industry but also became the most consequential attack in human history. According to blockchain analytics firm Arkham, the attack was likely carried out by the notorious hacking organization sponsored by the North Korean state.

North Korean’s Lazarus Group Linked to Record $1.4 Billion Bybit Heist

The link was established through an on-chain analysis conducted by pseudonymous blockchain investigator ZachXBT, who identified connections between the wallets used in the attack and previous exploits attributed to Lazarus. As a result, Arkham awarded ZachXBT a $50,000 bounty for his findings.

Lazarus has been responsible for multiple high-profile cyber heists in recent years, including the $600 million hack of the Ronin Network in 2022. U.S. law enforcement agencies have long accused North Korea of using crypto-related cybercrimes to fund its regime.

While ZachXBT has yet to release detailed findings, he stated that he and a colleague identified North Korean involvement by tracing wallet activity.

The same addresses were reportedly linked to an $85 million exploit of Phemex, a Singapore-based crypto exchange, last month. Phemex also suffered a $73 million attack in January, further underscoring Lazarus’ continued operations in the sector.

According to Chainalysis, North Korean-affiliated cybercriminals stole $1.34 billion in cryptocurrency in 2024, accounting for 61% of all illicit crypto-related thefts that year.

North Korean hacking activity
North Korean hacking activity. Source: Chainalysis

Hackers Drain 70% of Bybit’s Ether Holdings in Cold Wallet Breach

The Bybit breach, which occurred early Friday, involved a hacker accessing the exchange’s cold wallet—a storage method considered more secure than online alternatives.

More than 401,000 Ether, valued at $1.4 billion at the time, was transferred to an unidentified wallet. Bybit CEO Ben Zhou confirmed the stolen amount accounted for approximately 70% of the exchange’s Ether holdings. The exchange secured a bridge loan from “unnamed partners” to cover almost 80% of the Ether stolen in the hack, Zhou stated.

Bybit has reported the attack to authorities and is collaborating with blockchain analytics firms to track and isolate the stolen funds. The company is working to prevent hackers from cashing out through legitimate markets, though efforts to recover stolen assets remain uncertain.

Rate this post

Other Posts: