The Federal Bureau of Investigation (FBI) has stated that North Korean hackers were responsible for the $1.5 billion raid on the cryptocurrency exchange Bybit.
The heist is thought to be the biggest single digital theft ever, with the hacker collective known as Lazarus said to be responsible.
In a public service announcement, the FBI has intimated that the Pyongyang-sponsored group was responsible, using spearfishing methods and crypto apps with embedded malware to conduct the attack.
This is a campaign the FBI has referred to as “TraderTraitor”.
“TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets to Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains,” said the FBI communication.
“It is expected these assets will be further laundered and eventually converted to fiat currency,” it added.
Earlier this week, Dubai-based Bybit reacted to the stinging loss, with the company insisting it was strong enough to bounce back from the $1.5b hack.
Company CEO Ben Zhou stressed that all other crypto holdings were safe, and even if it does not manage to return any of the stolen digital currency, all of those impacted would receive a full refund.
It is believed that the threat actors took control of an Ethereum wallet before removing the vast haul of assets to an unknown external address.
The gang was able to manipulate a routine transfer of Ethereum from an offline “cold” wallet to a “warm” wallet, exploiting security controls to full effect.
Largest crypto heist in history.
FBI accuses North Korea of being behind the theft of $1.5 billion worth of digital assets last week. The bureau said a group called TraderTraitor, also known as the Lazarus Group, was behind the thefthttps://t.co/wijIkLRODK pic.twitter.com/fqpuA9Soqj
— AFP News Agency (@AFP) February 27, 2025
War on Lazarus
In a further response, Bybit’s Zhou has declared a “war against Lazarus”, vowing to unleash a relentless pursuit of threat actors in the crypto industry.
As a pariah state, North Korea remains subject to various punitive international sanctions, but this situation also acts as a catalyst for funding weapons programs through illegal cyber activity.
Last year, a United Nations Security Council panel report outlined that the state funds 40% of its missile and nuclear endeavors from “illicit cybermeans”, adding that 58 suspected attacks attributed to North Korea-sponsored actors gathered around $3 billion for the country’s regime between 2017 and 2023.
Image credit: Grok/X
