Bybit Offers $140M Bounty After Historic $1.4B Hack

Cryptocurrency exchange Bybit launched a massive $140 million bounty program on Tuesday to trace and freeze $1.4 billion in Ethereum stolen during last week’s historic cyberattack, which security experts attribute to North Korea’s notorious Lazarus Group.

Bybit’s CEO and co-founder, Ben Zhou, announced the bounty initiative on X (formerly Twitter) as the company scrambles to recover from what is believed to be the largest cryptocurrency heist in history.

How the $140 Million Recovery Bounty Works

According to the official bounty portal, Bybit has structured the reward system to incentivize both independent researchers and institutional entities. For every successful recovery effort, 5% of the retrieved funds will be awarded to the individual who traced the assets, while another 5% will go to the entity that executes the freeze on the stolen cryptocurrency.

The aggressive recovery campaign is already yielding results. Bybit has already distributed $4.23 million in rewards to five bounty hunters who successfully aided in tracking portions of the stolen Ethereum. The bounty platform features a highly provocative logo depicting a knife piercing the head of North Korean leader Kim Jong-un, underscoring the adversarial nature of the operation.

Targeting the State-Backed Lazarus Group

“We will not stop until Lazarus or bad actors in the industry is eliminated. In the future we will open it up to other victims of Lazarus as well,” Zhou stated, referring to the Lazarus Group. This designation is used across the cybersecurity industry to identify a sophisticated network of state-sponsored hackers operating on behalf of the North Korean government.

Cybersecurity firms and blockchain monitoring agencies widely agree that the scale and execution of the Bybit exploit point directly to Pyongyang. According to intelligence reports from the United States, Japan, and South Korea, North Korean cyberwarfare units have become highly proficient at targeting Web3 enterprises and centralized exchanges, accounts for over $650 million in stolen crypto assets in 2024 alone.

Forensics Trace Breach to Compromised SafeWallet Code

On Wednesday, Zhou published preliminary findings from a joint forensic investigation conducted by cybersecurity firms Sygnia Labs and Verichains. The investigation identified the root cause of the security failure as a compromise within the infrastructure of SafeWallet, a prominent digital wallet platform.

According to the forensic reports, threat actors successfully breached a developer’s device at SafeWallet—an intrusion subsequently confirmed by SafeWallet. This unauthorized access allowed the hackers to replace a benign JavaScript file with a malicious payload specifically engineered to target and compromise Bybit’s Ethereum Multisig Cold Wallet.