North Korea’s Lazarus Group Steals $1.5B from Bybit!

In what’s being called the biggest crypto hack in history, the notorious North Korean hacker group Lazarus has been linked to the massive $1.5 billion exploit on Bybit. Blockchain intelligence firm Arkham Intelligence confirmed the group’s involvement, citing evidence from onchain sleuth ZachXBT.

The attackers executed the breach using a method known as “Blind Signing,” which allows transactions to be approved without full visibility into their contents. Bybit’s ETH cold wallet was compromised, leading to the transfer of nearly $1.5 billion worth of assets into a single wallet before being dispersed across multiple wallets.

The Hunt for the Hackers

Before Arkham confirmed Lazarus’ involvement, the firm offered a 50,000 ARKM bounty for anyone tracking the perpetrators. ZachXBT provided a detailed analysis, tracing the stolen funds through test transactions and forensic data. His findings left no doubt that the attack was the work of Lazarus.

Blockchain security firm Blockaid’s CEO Ido Ben Natan explained that Blind Signing attacks have become a go-to strategy for sophisticated hackers, including North Korea. Similar methods, like the Radiant Capital and WazirX incidents, were used in previous breaches.

Funds on the Move

Blockchain data firm Nansen revealed that the stolen funds were initially placed in a primary wallet before being divided among over 40 different wallets. The attackers then converted all stETH, cmETH, and mETH holdings to ETH, systematically transferring chunks of $27 million to more than 10 additional wallets. This method made tracking and recovering the funds significantly harder.

North Korea’s Cyberwarfare & Financial Motivations

10x Research highlights that Lazarus’s cyberattacks are not merely criminal activities but a state-sponsored initiative to fund North Korea’s military projects. The U.S. government estimates that crypto-related cybercrimes finance up to 30% of North Korea’s missile programs. Hackers are selected from a young age and trained extensively, with top talents sent to China for advanced cyber education.

The Lazarus Group’s exploits include infamous breaches like the Ronin Network ($625m), KuCoin ($285m), and Binance Bridge ($570m). Their techniques remain undetected, adapting to the latest security protocols while using social engineering and malware to penetrate even the most secure platforms. Moreover, they rely on DeFi platforms like Uniswap to launder money since these platforms don’t require KYC checks. Interestingly if North Korea is behind all this then they will become the 14th largest holder of Ether, beating the holdings of Ethereum co-founder Vitalik Buterin as per data. 

• Also Read :
•   Pi Network Clears the Air After Bybit CEO Calls It a Scam, Pi Coin Rises by 20%
•   ,

Bybit Responds

Bybit CEO Ben Zhou confirmed that despite the loss, the exchange remains financially stable. He acknowledged that the hacker had managed to seize control of an ETH cold wallet but assured users that Bybit’s solvency remains intact, even if the stolen funds are not recovered.

With North Korea’s Lazarus Group repeatedly pulling off high-profile crypto heists, the industry faces increasing pressure to bolster security against such sophisticated threats.