Bybit’s $1.5 Billion Hack: How North Korea’s Lazarus Group Stole the Spotlight

• ZachXBT identified Lazarus through blockchain analysis, revealing their signature in Bybit’s Ethereum wallet breach.
• Lazarus has a history of crypto attacks, including Axie Infinity ($617M) and Harmony Horizon ($100M), using advanced techniques.

On February 21, 2025, the cryptocurrency industry was rocked by shocking news: the crypto exchange Bybit suffered what has been labeled the largest hack in the sector’s history, with an estimated loss of nearly $1.5 billion in tokens.

Arkham Intelligence, announced via its X account that the mystery behind this massive attack had been solved thanks to the work of renowned on-chain investigator ZachXBT.

#Bybit situation: @arkham has confirmed @zachxbt has provided verifyable evidence North Korean #Lazarus Group was behind the #Bybit social engineering, multisig exploit and subsequent hack of the $ETH and $STETH cold storage wallets. https://t.co/f9KEcN9xdT

— MartyParty (@martypartymusic) February 21, 2025

In a post published at 20:21 UTC, Arkham detailed that ZachXBT provided definitive evidence identifying the Lazarus Group, linked to the North Korean government, as the perpetrator behind the hack on Bybit’s Ethereum wallet.

The hack, described by Bybit CEO Ben Zhou, involved unauthorized access to an offline wallet, allowing the attackers to transfer assets worth approximately $1.46 billion in a series of suspicious transactions.

Bybit ETH multisig cold wallet just made a transfer to our warm wallet about 1 hr ago. It appears that this specific transaction was musked, all the signers saw the musked UI which showed the correct address and the URL was from @safe . However the signing message was to change…

— Ben Zhou (@benbybit) February 21, 2025

Arkham, which had previously offered a bounty of 50,000 ARKM (equivalent to over $30,000) to identify those responsible, shared ZachXBT’s findings with the Bybit team to support their investigation.

WE’VE COMPILED A LIST OF BYBIT HACKER WALLETS

The Bybit Hacker currently holds $1.37B of ETH and has used 53 wallets so far.

Wallet list below: pic.twitter.com/oQK1MhYkqg

— Arkham (@arkham) February 21, 2025

The evidence presented by ZachXBT included a detailed analysis of test transactions, connected wallets, and forensic graphs that revealed the distinctive “fingerprint” of the Lazarus Group on the blockchain—a signature previously associated with attacks on other crypto platforms.

The Lazarus Group, known for its ties to North Korea’s military intelligence, has a history of high-profile cyberattacks in the crypto space, including the theft of $617 million in the Axie Infinity hack of 2022 and the $100 million attack on Harmony Horizon.

According to reports from ETHNews analysts and outlets like BleepingComputer and Bloomberg, the group has exploited the anonymous nature of crypto transactions to move large sums without leaving a trace, using techniques such as private key theft and cryptocurrency mixing services. This pattern was repeated in the Bybit case, where the attackers exploited vulnerabilities to access funds and disperse them quickly.

BREAKING: BYBIT $1 BILLION HACK BOUNTY SOLVED BY ZACHXBT

At 19:09 UTC today, @zachxbt submitted definitive proof that this attack on Bybit was performed by the LAZARUS GROUP.

His submission included a detailed analysis of test transactions and connected wallets used ahead of… https://t.co/O43qD2CM2U pic.twitter.com/jtQPtXl0C5

— Arkham (@arkham) February 21, 2025

The resolution of the case by ZachXBT, described by the X community as a “legendary” figure in his field, sparked a wave of reactions on social media. Users like JulbyJuli.eth, David Owens, and others celebrated his work, while some speculated about the geopolitical implications, even joking about potential extreme responses against North Korea.

However, ZachXBT and other experts, such as Coinbase’s Conor Grogan, emphasized that the involvement of a state actor like Lazarus complicates recovery efforts, as nations can operate outside the reach of traditional international laws.

The post Bybit’s $1.5 Billion Hack: How North Korea’s Lazarus Group Stole the Spotlight appeared first on ETHNews.