Bybit’s $1.46 Billion Hack: A Possible Lazarus Group Cash-Out Route

2025-02-22 · Original on Telegram · Markdown ·2.05K views

Summary

Bybit’s $1.46 Billion Hack: A Possible Lazarus Group Route to Pyongyang Background North Korea’s Lazarus Group is a hacking organization linked to the Reconnaissance General Bureau. Active since 2007, it has been associated with incidents including Sony Pictures in 2014 and WannaCry in 2017.

Bybit’s $1.46 Billion Hack: A Possible Lazarus Group Route to Pyongyang

Background
North Korea’s Lazarus Group is a hacking organization linked to the Reconnaissance General Bureau. Active since 2007, it has been associated with incidents including Sony Pictures in 2014 and WannaCry in 2017. It has targeted crypto since 2017, with thefts including Youbit ($70 million) and Coincheck ($530 million), and has stolen more than $3 billion in total. That exceeds North Korea’s $142 million in annual exports; the funds support nuclear weapons and missile programs while circumventing sanctions.

Incident overview
On February 21, 2025, Bybit suffered what was described as the largest crypto theft on record, losing $1.46 billion (1.9 trillion KRW). The assets stolen were 401,346 ETH ($1.12 billion), 90,376 stETH ($253 million), 15,000 cmETH ($44 million) and 8,000 mETH ($23 million). ZachXBT and Arkham Intelligence attributed the attack to Lazarus Group using onchain analysis.

The attack occurred during a transfer from Bybit’s ETH multisig cold wallet to a warm wallet. The hackers manipulated the signing interface, changed smart contract logic and sent the funds to 0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2 while making the transaction appear legitimate. Bybit CEO Ben Zhou said the exchange’s hot and other cold wallets were safe, but ETH fell 3% to $2,640, unsettling the market. Bybit, which held $20 billion in assets, promised 1:1 backing and a bridge loan covering 80% of the loss.

Lazarus Group’s possible cash-out strategy
Lazarus Group is already working to turn the $1.46 billion into cash for Pyongyang. The following outlines a possible laundering process.

🔴 Splitting the funds
Within 24 hours, the $1.46 billion was distributed across more than 49 addresses, including 0xcEA1A76f2d8e0881b9b185F229e49E3928d37A04. Arkham Intelligence observed more than $200 million in stETH being swapped for ETH and divided into 500–1,000 ETH chunks to evade tracking. The pattern resembles the 2022 Ronin hack, in which $625 million was split across more than 100 addresses in 48 hours.

🟠 Mixing
The funds could next pass through DEXs such as Uniswap or PancakeSwap and be converted into USDT or Tron. Cross-chain bridges could move them from Ethereum to Tron or Bitcoin. Before the 2022 sanctions, the group relied on Tornado Cash; it now uses mixers such as Sinbad.io or newer services. Elliptic identified $24.2 million from a 2024 hack moving to Sinbad, and Chainalysis said more than 60% of the $100 million stolen from Atomic Wallet in 2023 moved to Tron. The group targets blockchains that make tracing difficult.

🟡 OTC cash-out
The mixed funds could move to OTC desks in lightly regulated locations, such as Huione Pay in Cambodia or hubs in Southeast Asia. Shell companies or other accounts could cash out through bank transfers, cash drops or deals with Russian and Chinese dark-pool traders. Elliptic traced $35 million from the $100 million Horizon Bridge hack in 2022 through OTC channels, including cash drops in Thailand. At least $500 million from the Bybit theft could be cashed out through OTC intermediaries.

🟢 Transfer to Pyongyang
Once cashed out, the funds could be sent to Pyongyang to support nuclear weapons development and the regime. TRM Labs says Lazarus Group has stolen more than $2 billion since 2018, including $1 billion in 2022, far exceeding North Korea’s $142 million in annual exports. A 2023 UN report links the funds to missile tests, which cost $600 million a year, and cyber operations. The $1.46 billion could support the country’s economy for years.

Why the pattern is familiar
The Atomic Wallet ($100 million, 2023), Ronin ($625 million, 2022) and KuCoin ($280 million, 2020) hacks followed a similar pattern: key theft through social engineering, multiple layers of mixing and OTC cash-outs. The Bybit attack exposed exchange security weaknesses; without stronger multisig procedures, real-time tracking and phishing defenses, Lazarus Group will continue to succeed.