By 
A massive $1.5 billion cryptocurrency theft from exchange Bybit has been linked to North Korea’s infamous Lazarus hacking group, marking the largest crypto heist in history.
Bybit Security Breach
The attack occurred on February 21, 2025, when hackers intercepted a routine transfer of funds from Bybit’s cold wallet to a hot wallet.
Bybit disclosed that the attackers manipulated smart contract logic, altering the signing interface to gain control of the cold wallet. As a result, over 400,000 ETH and stETH tokens, valued at more than $1.5 billion, were funneled into an unauthorized blockchain address.
Despite the attack sparking 580,000 withdrawal requests, Bybit assured users that its services remained operational, and other assets were secure. The exchange has since replenished its ETH reserves and confirmed its financial stability.
Lazarus Group’s Involvement
Blockchain investigator ZachXBT traced the stolen funds to addresses associated with previous hacks involving Poloniex, BingX, and Phemex—three exchanges previously targeted by Lazarus.
Further analysis revealed that hackers used a network of over 920 blockchain addresses and engaged in Pump Fun meme coin trading to launder stolen assets. Additionally, they leveraged the centralized mixer eXch and Chainflip to convert ETH into Bitcoin.
Blockchain intelligence company TRM Labs confirmed that the Bybit hackers were affiliated with Lazarus, citing substantial overlaps with prior North Korean crypto thefts. Elliptic, another blockchain intelligence firm, reported that the stolen funds were rapidly moved through multiple wallets to obscure their origins.
Crypto Laundering Tactics and Response
Elliptic’s chief scientist, Tom Robinson, noted that despite Bybit’s requests, eXch processed tens of millions in stolen funds. If past patterns hold, the Lazarus group will likely use Bitcoin mixers next to further conceal the money trail.
In response to accusations, eXch denied knowingly laundering funds, stating that any amount that entered their platform was an “isolated case” and that fees collected would be donated to public causes.
This attack follows a record-breaking year for North Korean cybercrime. In 2024, hackers linked to Pyongyang stole $1.34 billion across 47 attacks, surpassing their previous record of $1.1 billion in 2022.
Notably, in March 2022, Lazarus and BlueNorOff stole $620 million from Axie Infinity’s Ronin bridge, one of the largest crypto breaches at the time.
