North Korean Lazarus Group Behind Crypto’s Largest Hack: $1.5 Billion Stolen from Bybit
Lazarus Group Executes Largest Crypto Theft of All Time, Says Arkham Intelligence
In what is being dubbed the largest crypto theft in history, North Korea’s Lazarus Group has been identified as the culprit behind the $1.5 billion hack of the cryptocurrency exchange Bybit. According to Arkham Intelligence, the hack took place on February 21, 2025, and has left the crypto market in shock. The attack, described as a massive breach, has far surpassed previous incidents in scale and sophistication.
How the Lazarus Group Carried Out the $1.5 Billion Hack
The hack, which Arkham Intelligence confirmed through on-chain sleuth ZachXBT, involved a series of calculated moves. Initially, the attackers withdrew nearly $1.5 billion worth of digital assets from Bybit’s exchange into a primary wallet. From there, they proceeded to distribute the stolen funds across more than 40 different wallets.
The funds were converted from various forms of Ethereum-based assets, such as stETH, cmETH, and mETH, into ETH, before being systematically transferred in $27 million increments to over 10 additional wallets. This methodical approach made tracking the stolen assets more difficult.
Blind Signing: The Vulnerability Exploited in the Hack
The attackers used a technique called “Blind Signing” to execute the hack. This method involves approving smart contract transactions without fully understanding the transaction details. Blind Signing has become increasingly common among advanced cybercriminals, especially those backed by state actors like North Korea’s Lazarus Group.
Ido Ben Natan, CEO of Blockaid, a blockchain security firm, explained the risks of Blind Signing: “Most of the signing process is delegated to software interfaces that interact with decentralized applications (dApps), creating a critical vulnerability. This allowed the hackers to manipulate the process and carry out the attack.”
This attack vector has previously been used in other major breaches, including the Radiant Capital breach and the WazirX incident, highlighting its growing prevalence.
The Aftermath and Market Reaction
The hack has sent shockwaves through the crypto market, causing prices to tumble in its wake. Elliptic’s Tom Robinson, co-founder and chief scientist, called it the “largest crypto theft of all time, by some margin,” noting that it dwarfs the $611 million Poly Network hack of 2021. Some industry experts are even considering this breach to be the largest single theft in the history of cryptocurrency.
Bybit CEO Ben Zhou confirmed in a social media post that the hackers gained control of a specific Ethereum cold wallet, transferring all of its assets to an unidentified address. Despite the massive loss, Zhou reassured users that the exchange remains solvent, even if the stolen funds are not recovered.
Arkham’s Investigation and Ongoing Efforts to Trace the Hackers
Arkham Intelligence offered a 50,000 ARKM token bounty for information leading to the identification of the attackers. In an update, they confirmed that ZachXBT’s analysis provided definitive proof linking the hack to the Lazarus Group, a notorious North Korean hacking collective that has been responsible for several high-profile crypto thefts in the past.
The firm’s on-chain analysis revealed detailed patterns of the attack, including test transactions and connected wallets, which helped confirm Lazarus Group’s involvement. This connection further underscores the growing risks of cyber-attacks on crypto exchanges and the need for robust security protocols in the industry.
Conclusion: The Growing Threat of State-Sponsored Cybercrime in Crypto
The Bybit hack serves as a stark reminder of the increasing vulnerability of cryptocurrency exchanges to state-backed cybercrime. North Korea’s Lazarus Group has demonstrated their ability to execute complex, large-scale thefts, using techniques like Blind Signing to bypass traditional security measures.
As the investigation continues, exchanges and investors alike are urged to adopt more stringent security measures and stay vigilant against emerging threats. For now, the crypto community is left to grapple with the fallout of what is being regarded as the largest hack in crypto history, one that highlights the need for improved cybersecurity across the industry.
For more on crypto security and the latest developments in the aftermath of the Bybit hack, stay tuned to our coverage.
