Inside the $1.46 Billion Bybit Hack: How Lazarus Group Could Move the Funds to Pyongyang

Inside the $1.46 Billion Bybit Hack: How Lazarus Group Could Move the Funds to Pyongyang

Background
North Korea’s Lazarus Group is a globally notorious hacking group that operates under the Reconnaissance General Bureau. It began conducting cyberattacks in 2007 and was responsible for major incidents including Sony Pictures in 2014 and WannaCry in 2017. Since the crypto market took off in 2017, it has focused on exchanges including Youbit ($70 million, 2017) and Coincheck ($530 million, 2018), stealing more than $3 billion in total. That far exceeds North Korea’s annual exports of $142 million. The funds are used to finance nuclear weapons development and missile programs, raising serious international concerns.

Incident overview
On February 21, 2025, Bybit suffered the largest hack in crypto history. The losses totaled 1.9 trillion won ($1.46 billion): 401,346 ETH ($1.12 billion), 90,376 stETH ($253 million), 15,000 cmETH ($44 million) and 8,000 mETH ($23 million) were stolen. Onchain investigator ZachXBT and Arkham Intelligence identified Lazarus Group as the perpetrator.
The attack occurred as funds were being transferred from Bybit’s ETH multisig cold wallet to a warm wallet. The attacker manipulated the signing interface to alter the smart contract logic, disguised the destination as a legitimate address and transferred all the funds to 0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2. Bybit CEO Ben Zhou said the exchange’s hot wallet and other cold wallets were safe, but ETH fell 3% to $2,640, rattling the market. Bybit holds $2 billion in assets, has pledged to back customer funds 1:1 and plans to cover 80% of the losses with a bridge loan.

Lazarus Group’s cash-out strategy
Lazarus Group is already executing a plan to cash out the 1.9 trillion won and transfer it to Pyongyang. Its money laundering process is meticulous and organized. Here is a breakdown of the potential stages.

🔴 Dispersal
Within 24 hours of the hack, the funds were spread across more than 49 addresses, including 0xcEA1A76f2d8e0881b9b185F229e49E3928d37A04. According to Arkham Intelligence, more than $200 million in stETH was converted to ETH and split into batches of 500–1,000 ETH to evade tracking. This resembles the pattern seen in the Ronin hack ($625 million, 2022), when funds were split across more than 100 addresses within 48 hours.

🟠 Mixing
The dispersed funds will likely be converted into USDT or Tron on DEXs such as Uniswap or PancakeSwap. They could also move from Ethereum to Tron or Bitcoin through cross-chain bridges. The group previously used Tornado Cash but has turned to newer mixers such as Sinbad.io since U.S. sanctions were imposed in 2022. Elliptic identified $24.2 million from another hack moving to Sinbad in late 2024, while Chainalysis reported that more than 60% of the funds from the Atomic Wallet hack ($100 million, 2023) moved to the Tron network. The strategy involves choosing complex blockchains to obstruct tracking.

🟡 OTC cash-out
The mixed funds are expected to move to OTC desks in lightly regulated jurisdictions. Huione Pay in Cambodia and small exchanges in Southeast Asia are potential routes. The group could also use shell companies or personal accounts for bank transfers and cash withdrawals, or transact with black-market dealers in Russia and China. Elliptic traced $35 million from the Horizon Bridge hack ($100 million, 2022) to cash withdrawals in Thailand. In this case, at least $500 million is expected to be cashed out through OTC channels.

🟢 Transfer to Pyongyang
The proceeds are expected to be transferred to Pyongyang for nuclear weapons development and to support the regime. According to TRM Labs, Lazarus Group has stolen more than $2 billion since 2018, including $1 billion in 2022 alone. That is a substantial sum compared with North Korea’s annual exports of $142 million. A 2023 UN report says such funds are used for missile tests, which cost $600 million a year, and cyber force operations. The 1.9 trillion won stolen in this case could sustain North Korea’s economy for several years.

A recurring pattern
The incident follows the same pattern as the Atomic Wallet ($100 million, 2023), Ronin ($625 million, 2022) and KuCoin ($280 million, 2020) hacks: steal private keys through social engineering, use multiple layers of mixing to obstruct tracking, then cash out through OTC channels. The Bybit hack exposed weaknesses in exchange security. Without stronger multisig processes, real-time onchain monitoring and employee training against phishing, Lazarus Group’s attacks cannot be stopped.

Further reading
Funds sent to Sinbad.io: $24.2 million identified in late 2024 (Elliptic: North Korean Hackers and Sinbad - www.elliptic.conorth-korean-h…
Horizon Bridge OTC case: $35 million cashed out, Thailand drop (Elliptic: Horizon Bridge Exploit Analysis - www.elliptic.cohorizon-bridge…
Ronin dispersal pattern: $625 million, more than 100 addresses (Chainalysis: Ronin Bridge Hack - www.chainalysis.com)
TRM Labs statistics: $2 billion since 2018 (TRM Labs: North Korea Crypto Heists - www.trmlabs.comnorth-korea-cr…
UN report: links to nuclear weapons financing (UN Panel of Experts Report - www.un.orgreports)

Source: Funkyonchain