Loading story…
Crypto exchange Bybit lost about $1.5 billion in Ethereum-linked assets after attackers compromised the platform in what has been described as the largest cryptocurrency theft on record. Blockchain investigators at TRM Labs and a subsequent FBI/IC3 public attribution linked the operation to North Korean threat actors, citing wallet overlaps and tradecraft consistent with earlier DPRK-backed campaigns. Reporting tied the theft to a broader pattern of financially motivated North Korean operations that have previously targeted major crypto platforms and financial institutions.
After the theft, the stolen funds were moved at high speed through intermediary wallets, decentralized exchanges, and cross-chain bridges, with a large share ultimately converted into Bitcoin. Analysts said the laundering operation showed an evolution in DPRK tactics away from reliance on traditional mixers and toward rapid, high-volume cross-chain obfuscation; later reporting said more than $1 billion had been laundered within months. The heist also triggered recovery efforts, including Bybit's 10% bounty program for frozen or recovered assets, and intensified debate over cryptocurrency oversight and the implications for future U.S. regulation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
By 2025-07-22, reporting said North Korean hackers had laundered over $1 billion of the funds stolen from Bybit in under six months. This marked a major escalation in the post-heist movement of the stolen assets.
Within days of the theft, the attackers shifted hundreds of millions of dollars through intermediary wallets, decentralized exchanges, and cross-chain bridges, with much of the value ultimately converted into Bitcoin. Analysts noted this reflected a DPRK laundering shift away from traditional mixers toward faster, high-volume cross-chain obfuscation.
In the aftermath of the hack, Bybit announced a 10% bounty program to incentivize the freezing or recovery of stolen funds. The measure was part of broader efforts with investigators and law enforcement to trace and claw back assets.
On 2025-02-26, the FBI/IC3 publicly stated that North Korea was responsible for the $1.5 billion Bybit hack. This formalized the attribution already emerging from private-sector blockchain intelligence.
By 2025-02-23, reporting indicated North Korean hackers were suspected of being behind the Bybit theft. Blockchain investigators linked the stolen funds to wallets and patterns associated with prior DPRK-linked operations and began tracing rapid laundering activity.
On 2025-02-21, cryptocurrency exchange Bybit suffered a cyberattack that resulted in the theft of roughly $1.5 billion in Ethereum-based assets. The incident was described as the largest cryptocurrency exploit on record.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
thedefiant.io
Open sourcewilsoncenter.org
Open sourcecsis.org
Open sourcetrmlabs.com
Open sourceic3.gov
Open sourcechannelnewsasia.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Bybit said attackers stole about **$1.5 billion in Ethereum** after taking control of one of the exchange’s wallets during a routine transfer from a cold wallet to a warm wallet, making the breach one of the largest digital thefts on record. The Dubai-based exchange said customer assets remained fully backed and pledged to reimburse affected users even if the cryptocurrency is not recovered, while the incident triggered more than **350,000 withdrawal requests** and briefly pushed Ethereum’s price down by nearly **4%**. Blockchain investigators at TRM Labs said the stolen funds came from one of Bybit’s offline cold wallets and assessed with **high confidence** that **North Korean hackers** were responsible, citing substantial overlaps between attacker-controlled addresses and wallets tied to earlier North Korean thefts. TRM tagged the compromised addresses under **`Bybit Exploiter Feb 2025`** and tracked the assets in real time, while Bybit offered a **10% bounty** to cybersecurity and crypto-analytics experts who can help trace and recover the stolen funds.
Aug 15, 2026
North Korean hackers have stolen over $2 billion in cryptocurrency assets in 2025, marking the largest annual total ever attributed to the regime’s cyber operations. The majority of this record-breaking sum was taken in a single attack on the cryptocurrency exchange Bybit in February, where $1.46 billion was stolen. In addition to this major breach, blockchain analytics firm Elliptic has linked North Korean actors to more than thirty other cryptocurrency heists throughout the year. These attacks have targeted both exchanges and high-net-worth individuals, reflecting a shift in tactics by North Korean threat groups. The hackers have increasingly focused on wealthy crypto holders and employees of companies with significant digital asset holdings, exploiting the fact that individuals often have weaker security defenses than organizations. Social engineering has become a primary method, with attackers impersonating recruiters or investors to gain the trust of their targets. One common technique involves setting up fake video calls, during which the victim is tricked into running malicious command-line code, resulting in malware installation and subsequent theft of funds. The hackers have also been observed building elaborate fake profiles and leveraging compromised social media accounts to approach their targets. Notable additional breaches attributed to North Korean groups in 2025 include attacks on LND.fi, WOO X, Seedify, and the Taiwanese exchange BitoPro, with the latter resulting in an $11 million loss. The total amount stolen by North Korean hackers in 2025 is nearly triple the amount reported in 2024 and far exceeds the previous record of $1.35 billion set in 2022. These cyber-enabled thefts are believed to directly fund North Korea’s nuclear weapons program, according to the United Nations and various government agencies. Experts caution that the actual amount stolen may be even higher, as many incidents go unreported or lack sufficient evidence for definitive attribution. Discrepancies in reporting between blockchain analytics firms, such as Elliptic and Chainalysis, further complicate the assessment of the true scale of losses. The trend of targeting individuals, especially those with professional connections to major crypto firms, has made detection and prevention more challenging for standard cybersecurity tools. The sophistication and persistence of North Korean cyber operations underscore the regime’s growing reliance on cryptocurrency theft as a means of circumventing international sanctions and funding state objectives. The ongoing rise in cryptocurrency prices, particularly Bitcoin reaching all-time highs, has made the sector an even more attractive target for these state-sponsored actors. Security experts recommend heightened vigilance and advanced security measures for both organizations and individuals involved in the cryptocurrency ecosystem. The evolving tactics and increasing scale of North Korean cyber thefts highlight the urgent need for improved threat intelligence sharing and coordinated international response.
Jun 29, 2026
North Korean hackers were responsible for stealing over $2 billion in cryptocurrency in 2025, marking a 51% increase from the previous year and pushing their all-time total to $6.75 billion. The attacks were characterized by fewer but significantly larger breaches, with the compromise of Bybit alone resulting in the theft of approximately $1.5 billion. Attackers increasingly relied on embedding IT workers within crypto services and using sophisticated impersonation tactics to target executives, while also showing a preference for Chinese-language money laundering services and rapid laundering cycles. Chainalysis data revealed that more than $3.4 billion in cryptocurrency was stolen industry-wide in 2025, with the majority of losses concentrated in a handful of high-impact incidents. The top three hacks, all attributed to North Korean actors, accounted for 69% of confirmed breaches. While individual wallet compromises surged in number, the total value stolen from these incidents decreased, suggesting improved security practices in some areas. However, the scale and sophistication of nation-state attacks on centralized services remain a critical threat to the cryptocurrency ecosystem.
Jun 29, 2026