North Korea Accused of Record $1.4B Bybit Crypto Heist

On Friday, unidentified hackers siphoned approximately $1.4 billion in Ethereum from the cryptocurrency exchange Bybit in the largest digital asset heist in history, with security experts quickly pointing to North Korea’s state-sponsored Lazarus Group as the prime suspect.

On-Chain Data Points to Lazarus Group

Soon after the breach, prominent on-chain sleuth ZachXBT became the first to attribute blame, tracing the stolen funds to digital wallets previously associated with North Korean cyber operations. Specifically, the tracked paths intersected with addresses used in high-profile attacks against Phemex, BingX, and Poloniex.

When questioned about his certainty regarding North Korea’s involvement, ZachXBT stated he was “100%” confident, noting that global law enforcement agencies are currently operating under the same assumption.

Security Firms Confirm Laundering Patterns

Blockchain analytics firm Elliptic echoed these findings, launching a collaborative investigation with Bybit to trace the illicit transactions and block the regime from cashing out. In a detailed blog post, Elliptic explained that the attribution stems from distinct laundering methodologies unique to the Lazarus Group.

Tom Robinson, co-founder and chief scientist at Elliptic, confirmed that the stolen assets are actively being mixed with funds from previous North Korean cyber thefts. Robinson noted that the laundering tactics mirror past state-sponsored operations, alongside other classified indicators that cannot be publicly disclosed.

A Growing Pattern of State-Sponsored Theft

Adding weight to the consensus, blockchain intelligence agency TRM Labs published its own assessment, concluding with “high confidence” that Pyongyang orchestrated the attack. This latest incident aligns with North Korea’s long-standing strategy of utilizing cybercrime to fund its state operations.

According to a United Nations panel, the regime’s hackers have been tied to at least 58 separate crypto heists. Intelligence reports from the United States, Japan, and South Korea estimate that Kim Jong-Un’s government siphoned over $650 million through various crypto exploits throughout 2024 alone.

Official Responses Remain Muted

Despite the mounting evidence, Bybit spokesperson Tony Au declined to comment directly on the suspected North Korean link, stating only that the company’s internal team is still actively investigating the breach. Similarly, North Korea’s Permanent Mission to the United Nations did not respond to inquiries regarding the allegations.