Loading story…
The February 2025 theft of approximately $1.5 billion in cryptocurrency from Bybit was attributed to North Korean threat actors, making it one of the largest known cryptocurrency heists. Attackers manipulated a transaction involving Bybit's Ethereum cold wallet, transferring assets to wallets under their control before rapidly moving and laundering the funds across multiple services.
Open-source intelligence (OSINT) analysis linked infrastructure and operational artifacts associated with the theft to North Korean activity, consistent with tradecraft historically associated with the Lazarus Group and related DPRK-backed cryptocurrency theft operations. The incident underscores the continuing risk to exchanges and wallet operators from targeted compromise of transaction-signing workflows, trusted third-party infrastructure, and personnel involved in high-value asset transfers.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
A Safe{Wallet} developer's macOS workstation was compromised through a trojanized Python trading application. The attackers reportedly used the developer's temporary AWS credentials to access Safe{Wallet}'s environment and modify its S3-hosted frontend, enabling selective redirection of Bybit multisignature transactions.
The FBI attributed the approximately $1.5 billion theft from Bybit, which occurred on or about February 21, 2025, to North Korea's TraderTraitor activity. It published Ethereum addresses tied to the laundering effort and urged virtual-asset service providers to block related transactions.
A Netlas analysis describes the Bybit hack as involving $1.5 billion and reports that OSINT led to its attribution. The available reference metadata does not identify the attributed actor or date the event occurred.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 54 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
5 references tracked. Mallory keeps watching after this page renders.
netlas.io
Open sourceelastic.co
Open sourceic3.gov
Open sourcechainalysis.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Crypto exchange **Bybit** lost about **$1.5 billion** in Ethereum-linked assets after attackers compromised the platform in what has been described as the largest cryptocurrency theft on record. Blockchain investigators at TRM Labs and a subsequent **FBI/IC3** public attribution linked the operation to North Korean threat actors, citing wallet overlaps and tradecraft consistent with earlier DPRK-backed campaigns. Reporting tied the theft to a broader pattern of financially motivated North Korean operations that have previously targeted major crypto platforms and financial institutions. After the theft, the stolen funds were moved at high speed through intermediary wallets, decentralized exchanges, and cross-chain bridges, with a large share ultimately converted into **Bitcoin**. Analysts said the laundering operation showed an evolution in DPRK tactics away from reliance on traditional mixers and toward rapid, high-volume cross-chain obfuscation; later reporting said more than **$1 billion** had been laundered within months. The heist also triggered recovery efforts, including Bybit's **10% bounty** program for frozen or recovered assets, and intensified debate over cryptocurrency oversight and the implications for future U.S. regulation.
Jun 29, 2026
Bybit said attackers stole about **$1.5 billion in Ethereum** after taking control of one of the exchange’s wallets during a routine transfer from a cold wallet to a warm wallet, making the breach one of the largest digital thefts on record. The Dubai-based exchange said customer assets remained fully backed and pledged to reimburse affected users even if the cryptocurrency is not recovered, while the incident triggered more than **350,000 withdrawal requests** and briefly pushed Ethereum’s price down by nearly **4%**. Blockchain investigators at TRM Labs said the stolen funds came from one of Bybit’s offline cold wallets and assessed with **high confidence** that **North Korean hackers** were responsible, citing substantial overlaps between attacker-controlled addresses and wallets tied to earlier North Korean thefts. TRM tagged the compromised addresses under **`Bybit Exploiter Feb 2025`** and tracked the assets in real time, while Bybit offered a **10% bounty** to cybersecurity and crypto-analytics experts who can help trace and recover the stolen funds.
Aug 15, 2026
North Korean state-sponsored threat actors, including the Lazarus Group and Kimsuky, have been responsible for a dramatic surge in global cryptocurrency theft in 2025, stealing at least $2.02 billion—over half of the total $3.4 billion stolen worldwide. The February compromise of the Bybit cryptocurrency exchange accounted for $1.5 billion of these losses, with the attack attributed to the TraderTraitor cluster, and further links established through malware infrastructure analysis. Lazarus Group, affiliated with North Korea's Reconnaissance General Bureau, has also been implicated in the theft of $36 million from Upbit and is estimated to have stolen over $6.75 billion cumulatively through a series of high-profile heists and campaigns. Recent collaborative research by Hunt.io and the Acronis Threat Research Unit has uncovered new operational infrastructure used by both Lazarus and Kimsuky across global campaigns. The investigation revealed active tool-staging servers, credential theft environments, and tunneling nodes, highlighting the interconnected nature of DPRK cyber operations. Despite evolving malware and tactics, these groups consistently reuse infrastructure, making their activities traceable across campaigns. The findings provide defenders with actionable intelligence on the infrastructure patterns and operational habits of North Korean threat actors, supporting efforts to detect and disrupt ongoing and future attacks.
Jun 29, 2026