The Federal Bureau of Investigation delivered a definitive attribution on February 27, 2025, confirming that the Democratic People’s Republic of Korea was responsible for the theft of approximately $1.5 billion in virtual assets from cryptocurrency exchange Bybit. The FBI identified the threat actor as TraderTraitor, a North Korea-linked group also known as Lazarus, marking the largest cryptocurrency heist ever recorded and one of the largest single thefts of any kind in history.
The Bybit hack, which occurred on February 21, 2025, saw threat actors transfer over 401,000 ETH and stETH worth more than $1.5 billion to an unidentified address. Bitcoin traded at approximately $84,704 and Ethereum at $2,305 at the time of the FBI’s announcement, underscoring the sheer magnitude of the stolen assets. The theft surpassed previous records including the Ronin Network hack at $625 million, the Poly Network breach at $611 million, and the BNB Bridge exploit at $566 million.
The Exploit Mechanics
The attack targeted Bybit’s Ethereum cold wallet during a routine transfer to a warm wallet. The exchange uses a multisig system through Safe (formerly Gnosis Safe) for approving large transactions. According to Bybit CEO Ben Zhou, the manipulation occurred at the signing interface level. While the correct URL and destination address appeared on-screen, the underlying smart contract logic had been altered.
The hackers likely compromised the computers of all signers involved in the multisig approval process or exploited a vulnerability within the Safe platform’s user interface. Zhou confirmed he personally verified the URL and used a Ledger hardware device during signing. Despite these precautions, the attackers manipulated the transaction data at the smart contract level, exploiting the inherent complexity of Ethereum’s smart contract architecture.
Blockchain cybersecurity firm Elliptic was among the first to attribute the heist to Lazarus, followed by Arkham Intelligence. The rapid laundering of stolen funds through decentralized exchanges and cross-chain bridges bore the hallmark patterns of North Korean operations documented in previous attacks.
Affected Systems
The breach was confined to a single Ethereum cold wallet. Bybit confirmed that all other cold wallets, including those holding Bitcoin and USDT, remained fully secure and uncompromised. No other assets or wallet types were affected by the incident.
The compromised wallet held approximately 401,000 ETH, representing a significant portion of Bybit’s Ethereum reserves. At the time of the theft, this amount was valued at over $1.5 billion. The exchange stated it had over $20 billion in assets under management and maintained a 1:1 reserve ratio, which provided a buffer against complete insolvency.
Withdrawal processing continued throughout the crisis, with approximately 70 percent of withdrawal requests processed within the first several hours. Bybit secured bridge loans from partners to address the Ethereum liquidity deficit, ensuring continued operations without needing to purchase ETH on the open market.
The Mitigation Strategy
Bybit’s response involved multiple coordinated efforts. The exchange collaborated with leading blockchain forensic experts, including Elliptic and Chainalysis, to trace and potentially freeze stolen funds. Law enforcement agencies across multiple jurisdictions were engaged to assist in the recovery process.
The exchange also implemented enhanced security protocols for all remaining wallets. Bybit’s security team conducted comprehensive audits of all wallet systems to ensure no additional vulnerabilities existed. The company partnered with the Safe team to understand the root cause and identify weaknesses in the multisig signing process.
Zhou publicly guaranteed that customer funds were safe, emphasizing that Bybit would use its own reserves and partner bridge loans to cover the shortfall. The exchange committed to full transparency, providing regular updates through live streams and social media channels throughout the recovery process.
Lessons Learned
The Bybit hack exposed fundamental weaknesses in even the most sophisticated cold wallet security architectures. The fact that a multisig setup with hardware wallet verification could be compromised through interface manipulation represents a paradigm shift in threat assessment for cryptocurrency exchanges.
The incident highlights the growing sophistication of state-sponsored cybercrime targeting digital assets. North Korea’s Lazarus Group has consistently demonstrated an ability to adapt to defensive measures, employing increasingly complex social engineering and supply chain attack vectors.
Immunefi reported on the same day that crypto losses in February 2025 alone reached $1.53 billion, representing a 20-fold surge from January and nearly matching total losses for all of 2024. The overwhelming majority of these losses were attributable to the Bybit incident, but the report also documented additional exploits targeting DeFi protocols and individual wallets during the same period.
User Action Required
For users of Bybit and other centralized exchanges, the incident serves as a critical reminder to review security practices. Enable all available two-factor authentication methods. Consider distributing assets across multiple platforms rather than concentrating holdings in a single exchange. For large holdings, self-custody through hardware wallets with verified firmware remains the strongest defense against exchange-level compromises.
Users should also monitor official exchange communications during security incidents and act promptly on withdrawal advisories. The rapid processing of Bybit withdrawals demonstrated the importance of exchange liquidity reserves, but individual preparedness remains essential.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making any financial decisions.
401k ETH gone in minutes and bybit still operating like nothing happened. wild
thats because they got bailed out by whales and industry loans. doesnt mean the hole is filled though
Tomasz Nowak is right. bybit filled the hole with loans and whale deposits but that ETH is gone forever. laundering through tornado as we speak
Lazarus has been running this playbook for years. Ronin hack was the same group, just a smaller number.
ronin was $625m, this is $1.5b. the scale each time is absurd
segfault_ the jump from 625M to 1.5B in three years is terrifying. lazer is not slowing down they are accelerating
segfault_ the jump from 625M to 1.5B happened because Safe multisig UI got spoofed. hardware signing would have caught the blinded transaction. this was a UX exploit not a crypto exploit
multisig_autopsy_ calling it a UX exploit is the right framing. the signers approved a blinded transaction. hardware signing would have caught it instantly
multisig_autopsy_ calling it a UX exploit is spot on. the Safe UI showed a legit looking transaction but the delegate call was malicious. hardware screens would have shown the actual calldata
Jisoo P. calling it a UX exploit is the right take. the signers saw a legit looking transaction on the safe UI but the delegate call was malicious. hardware screens would have shown the calldata
ChainChad is right, same group same playbook. the difference is scale. each hack is bigger than the last
401k ETH moved through tornado in batches of 1000. on-chain forensics traced about 40% before the trail went cold. the rest is probably being washed through cross-chain bridges now
chain_snapshot_ 40% traced before the trail went cold. the other 60% is probably being washed through cross-chain bridges right now
chain_snapshot_ 60% untraced is the scary part. DPRK has had years to set up laundering infrastructure. those funds are long gone
401k eth in one transaction and nobody questioned the size. basic multisig limits would have saved 1.5 billion dollars
401k ETH stolen and nobody in tradfi cares because it is crypto. a bank heist of this size would be front page for a month
cold_bag_ tradfi absolutely would care if a 1.5B bank heist happened. but crypto is treated as the wild west so regulators just shrug and move on
cold_bag_ a 1.5B bank heist would absolutely dominate headlines for weeks. the fact that this faded in 3 days tells you everything about how crypto coverage works
401,000 ETH moved in one transaction. the sheer size of that transfer should have triggered every alarm in their security setup
Safe multisig UI got spoofed and 3 signers approved a delegate call without reading the calldata. 1.5 billion gone because nobody verified what they were signing. hardware screens would have caught it instantly
delegate_call_ the UX exploit angle is what makes this scary. the signers did everything right by their protocol, the interface lied to them. Safe still hasnt fully addressed the blind signing problem