North Korea's $1.5 Billion Bybit Heist Exposes Crypto Security Gaps and Global Stakes

A routine transfer opened the door to a record theft

On February 21, 2025, hackers stole nearly $1.5 billion in digital assets from Bybit, a cryptocurrency exchange based in Dubai with more than 60 million users. The attackers gained control of a wallet holding 401,000 Ether, or ETH, after chief executive Ben Zhou approved what appeared to be a routine transfer between company accounts.

The theft, the largest cryptocurrency heist ever recorded, began with a deception inside the software used to authorize transactions. Hackers had manipulated the interface so that a seemingly ordinary approval allowed them to take control of the wallet. Within minutes, the assets were transferred to addresses they controlled.

The FBI attributed the attack to North Korea. Its Lazarus Group and the operation known as TraderTraitor were identified as responsible, connecting a breach at a commercial exchange to a government accused of using stolen cryptocurrency to support its nuclear and missile programs.

By August 9, 2025, the case had become a warning about the connections between exchange security, outside software suppliers and global financial crime. Bybit had promised to cover customer losses, investigators had frozen tens of millions of dollars, and much of the stolen cryptocurrency had passed through a sprawling laundering network.

The scale reached far beyond one company. According to blockchain analysis firm Chainalysis, the Bybit theft accounted for nearly 70% of all digital assets stolen worldwide in the first half of 2025. Total cryptocurrency theft during that period exceeded $2.17 billion, with North Korean hackers responsible for nearly 70% of the total.

How the attackers changed what Bybit approved

Bybit used a free software product called Safe to store and manage digital assets. Investigators found that the attackers exploited a vulnerability in that software, manipulated its user interface and inserted malicious code. The interface is the screen through which someone reviews information and gives instructions.

Zhou believed he was approving a standard transfer of Ether, a popular cryptocurrency, between company accounts. The compromised software presented the transaction in a way that concealed what his approval would actually authorize. The attackers then gained control of the wallet containing 401,000 ETH.

Safe was an outside dependency: software supplied by another organization that Bybit relied on for an essential task. The breach showed how an attack against a supporting tool could reach the assets of the larger business using it.

The technique combined a software compromise with deception at the moment a person approved a transaction. A company could therefore face danger through both its technical systems and the information shown to employees making financial decisions.

Crypto markets fell during the fallout. Bitcoin dropped 20% from its January highs, while confidence in the industry weakened. The theft arrived as policymakers in the United States and elsewhere were debating rules intended to encourage broader adoption of digital assets.

Bybit promised protection while investigators pursued the money

Bybit assured customers that their funds would be covered and pledged to absorb customer losses. It also began working with forensic specialists to trace and recover the stolen assets.

The exchange launched a recovery bounty program offering rewards of up to 10% of recovered assets to people who helped identify, trace and freeze the stolen cryptocurrency. Within weeks, more than $40 million had been identified and frozen, and contributors had received more than $4 million in rewards.

A freeze prevents identified funds from being moved through a service or account that can block access. Tracing follows the movement of assets between addresses. Investigators needed both: a visible trail could help locate the money, while cooperation from a service holding it could create an opportunity to stop it moving again.

Experts warned that most of the stolen assets had already "gone dark" through sophisticated laundering channels and were likely unrecoverable. The final amount that could be returned remained uncertain as of August 9.

Why investigators pointed to North Korea

The FBI and international cybersecurity firms attributed the Bybit attack to North Korea's Lazarus Group and its subunit known as TraderTraitor. North Korea rarely claims responsibility for cyberattacks, but investigators described the evidence connecting its operatives to this theft as overwhelming.

Lazarus has become known for major cryptocurrency thefts whose proceeds are used to support the regime's nuclear and missile programs. TraderTraitor combines social engineering, attacks on software supply chains and technical exploits to reach blockchain businesses and cryptocurrency organizations.

Social engineering means manipulating a person into taking an action that helps an attacker. A software supply chain attack reaches a target through a tool, supplier or software component it trusts. In the Bybit case, the compromised transaction interface put that trust directly in the path of a financial approval.

The group's broader methods include fake job offers and malicious open source software. Open source software makes its underlying code available for others to inspect or use, but an attacker can still distribute a harmful package or compromise part of the development process.

Once inside an organization, the hackers deploy malware, steal login credentials and take cryptocurrency wallet keys. Those keys authorize access to digital assets. Stealing them can allow an attacker to divert funds to addresses controlled by North Korean operatives.

Employees, developers and cloud systems are targets

North Korean hackers have used phishing campaigns on LinkedIn, Slack and Telegram to persuade employees to download malware. Phishing messages impersonate a trusted person or opportunity to trick a recipient into handing over information or opening harmful software.

The attackers also compromise developer computers and insert malicious code into software supply chains. Their targets include cloud services and storage software, vulnerabilities highlighted by the Bybit breach.

Fake recruiters and supposed IT professionals are part of this approach. They offer job opportunities designed to persuade people to download malware or reveal credentials. Such tactics have proved effective against cryptocurrency companies that rely on remote employees and software from outside suppliers.

Benjamin Read, a security researcher at Wiz, described why TraderTraitor targets cloud infrastructure, the remotely operated computing services that businesses use to store information and run applications.

TraderTraitor focuses on cloud exploits because that's where the data and money are, especially for newer crypto companies with cloud-first infrastructure.

Cloud services, remote work and outside software give attackers several possible entry points. As cryptocurrency businesses expand, the range of systems and people they must protect also grows.

How quickly the stolen assets moved

The laundering began at speed. Within 48 hours of the theft, at least $160 million had been funneled through illicit channels. By the end of the first week, more than $400 million had moved.

By early March, the initial laundering phase was complete. The vast majority of the stolen Ethereum had been converted into Bitcoin and spread across thousands of wallets, increasing the number of transactions and addresses investigators had to follow.

The sequence shows how quickly the theft became an international recovery operation:

• February 21, 2025: Attackers stole nearly $1.5 billion from Bybit after compromising the transaction approval interface.
• Within 48 hours: At least $160 million had passed through illicit channels.
• By the end of the first week: More than $400 million had moved.
• By early March: The initial laundering phase had finished, with most of the stolen Ethereum converted into Bitcoin and dispersed across thousands of wallets.
• Within weeks of the theft: More than $40 million had been identified and frozen, and more than $4 million had been paid in recovery rewards.

Dr. Tom Robinson, cofounder of blockchain analytics firm Elliptic, described North Korea's laundering operation as both skilled and organized.

North Korea is the best at laundering crypto, likely using automated tools and working in shifts to turn crypto into cash.

Automation and people working in shifts can keep money moving while investigators and compliance teams try to identify where it has gone. The operation combined the resources of a state with the speed and flexibility of a criminal enterprise.

Bridges and mixers complicated the search

The hackers relied heavily on decentralized finance, often called DeFi, to move the stolen assets. These services allow cryptocurrency transactions without a conventional intermediary handling every transfer.

Cross-chain bridges, particularly THORchain, helped them swap assets between cryptocurrency networks. A bridge lets value move from one blockchain system to another. In this case, the attackers used such tools to convert stolen Ethereum into Bitcoin and make the trail harder to follow.

Large amounts of the converted Bitcoin then went into services such as Wasabi and CryptoMixer. These mixers blend transactions from multiple users, making the origin of particular coins extremely difficult to trace.

Blockchains publicly record transactions, allowing investigators to watch money move. The volume of transfers, changes between networks and mixing activity nevertheless overwhelmed compliance teams and investigators trying to follow the Bybit proceeds.

A substantial portion of the converted Bitcoin remained dormant. That suggested the hackers were preparing for large sales or further efforts to hide the money through over the counter networks, where buyers and sellers trade directly. Parts of China, described as having lax enforcement, were among the areas of concern.

Stolen cryptocurrency supports a sanctioned state

North Korea faces international sanctions and severe economic difficulties. Cryptocurrency theft has become a primary source of hard currency, money that the isolated regime can use beyond its domestic economy.

The United Nations estimates that North Korea has stolen more than $3 billion in cryptocurrency since 2017. Much of that money is believed to support its weapons programs, connecting losses at digital finance companies to wider security concerns.

Chainalysis attributed 61% of all stolen cryptocurrency funds in 2024 to North Korean hackers. The regime was on course to exceed that share in 2025, when its hackers accounted for nearly 70% of the more than $2.17 billion stolen worldwide in the first half of the year.

Those figures show a growing concentration of cryptocurrency theft in the hands of North Korean operatives. The Bybit raid alone was large enough to dominate the global theft total for the first six months of 2025.

North Korea's cyber operations also extend beyond direct theft. The regime places remote IT workers inside technology companies, where they can steal intellectual property and extort businesses. Proceeds are sent back to Pyongyang, supporting the economy and sanctioned weapons programs.

A growing operation with a history of major thefts

Lazarus and its subunits, including TraderTraitor, are believed to draw on thousands of personnel. Their operations are highly organized, with people working in shifts and combining government resources with methods associated with criminal enterprises.

The attackers continue to adapt. They use artificial intelligence to write convincing phishing emails, exploit new technologies and target both major exchanges and individual cryptocurrency wallets.

Several earlier thefts attributed to North Korea show the scale of the campaign before Bybit:

• The 2019 UpBit hack involved $41 million.
• The 2020 KuCoin theft involved $275 million.
• The 2022 Ronin Bridge attack involved $600 million.
• The 2023 Atomic Wallet breach involved $100 million.

The Bybit theft was about two and a half times the $600 million taken in the Ronin Bridge attack, using the stated values of the two incidents. It set a new record within a series of attacks displaying increasing technical sophistication and operational scale.

The combination of direct attacks, employee deception and infiltration through remote work gives North Korea several ways to generate revenue. Exchanges, software suppliers, technology employers and individual wallet holders all face parts of that campaign.

Why Asia's exposure matters beyond Dubai

Bybit is headquartered in Dubai, but its user base and operational focus are deeply rooted in Asia. Its breach exposed risks in a regional cryptocurrency market where rapid growth has outpaced the development of robust security standards.

Regulatory gaps and dependence on software from outside suppliers have left exchanges and investors exposed to increasingly sophisticated attacks. A weakness in a tool used to authorize transactions can reach customers across many jurisdictions, making the consequences difficult to contain within one country.

Chainalysis described what the incident revealed about the region's digital finance systems.

The incident "laid bare the widening security cracks in Asia's digital ecosystem and signaled the arrival of a new era of cybercrime."

Industry leaders and regulators began reassessing security after the theft. Governments and law enforcement agencies called for greater international cooperation and standardized security protocols for cryptocurrency exchanges.

The United States, under the Trump administration, had made cryptocurrency a major technology policy focus and sought to position the country as a global leader in digital finance. The Bybit attack brought consumer protection and security into that debate as policymakers considered how to encourage adoption.

Recovery depends on cooperation across services and borders

The FBI published lists of wallet addresses associated with North Korean hackers and urged exchanges and service providers to block transactions involving those addresses. Such alerts give businesses information they can use to identify and stop suspicious transfers.

Some cryptocurrency companies are unwilling or unable to comply. Decentralized services also complicate enforcement because there may be no central operator able to halt a transaction in the way a conventional financial institution could.

Bybit's bounty program and cooperation with blockchain analysis firms helped freeze tens of millions of dollars. Investigators still faced laundering networks operating across countries and services, while experts remained pessimistic about recovering most of the stolen assets.

The responses proposed after the breach focused on specific weaknesses exposed by the attack:

• Stronger exchange security standards, including regular audits and assessments of software from outside suppliers.
• More transparent information sharing between cryptocurrency businesses and law enforcement.
• International regulatory frameworks capable of addressing crime that crosses borders.
• Greater public awareness of phishing and social engineering risks.

For customers, Bybit's promise to cover losses addressed the immediate threat to their balances. For exchanges and regulators, the larger task was protecting the entire transaction process, including the software employees trust when they approve transfers, while coordinating action quickly enough to intercept stolen funds.

Key Points

• Hackers stole nearly $1.5 billion from Bybit on February 21, 2025, in the largest recorded cryptocurrency theft.
• The attackers compromised Safe's interface and deceived Bybit into approving a transaction that gave them control of a wallet holding 401,000 ETH.
• The FBI attributed the attack to North Korea, with Lazarus and TraderTraitor identified as responsible.
• Most of the stolen Ethereum was converted into Bitcoin and dispersed across thousands of wallets by early March.
• Bybit promised to cover customer losses. Within weeks, more than $40 million had been identified and frozen, and contributors had received more than $4 million in rewards.
• North Korean hackers accounted for nearly 70% of the more than $2.17 billion in cryptocurrency stolen worldwide during the first half of 2025.
• The case exposed weaknesses involving outside software, employee deception and international enforcement, with recovery of most funds considered unlikely.