Bybit’s $1.5B Hack Traced to North Korean Cybercriminals, Reports Reveal

Blockchain intelligence firm Arkham Intelligence has confirmed that North Korea’s Lazarus Group orchestrated the staggering $1.5 billion hack on crypto exchange Bybit. The revelation came after on-chain investigator ZachXBT provided critical forensic evidence linking the cyberattack to the infamous state-backed hacking collective.

Arkham had earlier placed a 50,000 ARKM token bounty for anyone who could identify the perpetrators. Following ZachXBT’s submission, Arkham stated that his analysis included detailed transaction tracing, wallet connections, and test transactions leading directly to Lazarus Group-controlled addresses.

Largest Crypto Theft in History

This attack has now set a new record as the largest crypto heist ever, surpassing the previous high of $611 million stolen from Poly Network in 2021.

Blockchain analytics firm Nansen reported that the hackers initially moved the stolen assets into a primary wallet before dispersing them across more than 40 addresses.

“The funds were first consolidated, then split into batches of $27 million each, with transactions distributed across multiple wallets,” Nansen said.

Blind Signing Exploit Used in the Attack

Security researchers believe the attackers leveraged a “Blind Signing” vulnerability, a technique that tricks users or systems into authorizing malicious transactions without fully understanding the contract’s contents.

“This method is rapidly becoming the go-to exploit for sophisticated hacking groups, including Lazarus,” said Ido Ben Natan, CEO of blockchain security firm Blockaid. “The same technique was responsible for major breaches at Radiant Capital and WazirX.”

He warned that even with robust key management, many platforms still rely on software-based signing mechanisms that are susceptible to manipulation.

Bybit CEO Addresses Security Breach

Bybit CEO Ben Zhou confirmed the hack in a statement on X, revealing that an Ethereum cold wallet was compromised.

“All ETH stored in this particular cold wallet was transferred to an unidentified address,” Zhou explained. However, he reassured users that Bybit remains financially stable despite the significant loss.

As North Korean cybercriminals continue targeting the crypto industry, the Bybit hack underscores the urgent need for enhanced security protocols to mitigate future threats.