North Korea's Lazarus Group Behind $1.46B Bybit ETH Hack
The cryptocurrency world was rocked when North Korea’s Lazarus Group orchestrated one of the largest heists in crypto history, stealing a staggering $1.46 billion from the Bybit exchange. The hackers have already begun laundering approximately $140 million of this sum through anonymous exchanges, converting it into Bitcoin, making the funds increasingly difficult to trace and recover.

Bybit’s response has been swift but challenging. In an effort to recover the stolen assets, the exchange has offered a 10% bounty—up to $140 million—rewarding those who help track down and retrieve the funds. However, this offer comes amidst growing panic, as Bybit has already seen around $6 billion in withdrawals. The funds are being rapidly moved off the platform, with significant Bitcoin balances plummeting from 70,000 BTC to just over 52,000 BTC.
The Lazarus Group is no stranger to high-profile crypto crimes. This group, often linked to North Korea, is notorious for stealing vast sums of cryptocurrency to fund the country’s ballistic missile program. Their methods are highly sophisticated, often utilizing decentralized exchanges, cross-chain bridges, and coin swap services to obscure the stolen funds. As seen in this latest breach, their laundering tactics are making it increasingly difficult for investigators to track the stolen assets and recover them.
One of the key players in the laundering operation is the anonymous exchange, eXch. Despite Bybit’s direct requests to halt the activity, eXch has processed tens of millions of dollars in stolen funds. In a statement, eXch claimed it didn’t comply with Bybit’s request due to past reputational conflicts between the two entities. This refusal has further complicated efforts to stem the flow of laundered assets.
In a coordinated effort, multiple platforms have successfully frozen a portion of the stolen funds. Tether, one of the largest stablecoin issuers, has frozen 181,000 USDT, while other platforms like THORChain have blacklisted wallets associated with the Lazarus Group. A total of $42.85 million in stolen funds have been frozen through these coordinated actions, but the hackers continue to find ways to move and launder the funds.
Bybit has also been working with the Solana Foundation to remove tokens linked to the hackers and has warned users about potential scammers impersonating Bybit officials to steal sensitive information. As the hack continues to unfold, members of the Ethereum community are discussing the possibility of a blockchain rollback to stop the hackers from further moving the funds. While no formal proposals have been made, these discussions are indicative of the high stakes involved.
As it stands, recovering the stolen funds remains a daunting challenge. The Lazarus Group’s use of decentralized platforms, anonymous exchanges, and other sophisticated techniques means that Bybit and the broader crypto community may face a long road ahead in tracing and recovering these assets. The outcome of this heist will likely shape the future of security within the cryptocurrency industry, making it a critical case to watch.