The Bybit Heist: How Lazarus Group Stole $1.5 Billion in the Largest Crypto Theft Ever

A Single Developer Machine, $1.5 Billion Gone

On February 21, 2025, cryptocurrency exchange Bybit lost approximately 401,347 ETH — roughly $1.5 billion — in what the FBI confirmed as the largest cryptocurrency theft in history. Five days later, the Bureau officially attributed the attack to North Korea’s TraderTraitor group, a component of the broader Lazarus Group operation that has been funding Pyongyang’s nuclear and ballistic missile programs through cybercrime for over a decade.

The heist did not exploit a flaw in blockchain protocols or smart contract logic. Instead, Lazarus compromised the development environment of Safe{Wallet}, the smart contract wallet platform Bybit used to manage its cold storage. The attackers gained access to a developer’s device through social engineering, then pivoted into the company’s network and code deployment systems.

Anatomy of a Supply Chain Heist

The technical analysis by NCC Group reveals a methodical operation spanning approximately 17 days from initial compromise to fund extraction.

On February 19, 2025, at 15:29:25 UTC, the attackers replaced a benign JavaScript file on `app.safe.global` with malicious code specifically designed to target Bybit’s Ethereum multisig cold wallet. The injected code was surgical — it would only activate during the next Bybit transaction, lying dormant for any other user of the Safe{Wallet} platform.

When Bybit initiated a routine transfer from its cold wallet to its warm wallet on February 21 at 14:13:35 UTC, the malicious code intercepted the transaction. Instead of executing the legitimate transfer, it redirected 401,347 ETH to an attacker-controlled wallet. The entire theft completed in a single transaction.

Blockchain investigator @ZachXBT independently confirmed the Lazarus attribution before the FBI’s official announcement, tracing the funds through patterns consistent with previous North Korean operations.

Laundering at Speed

Within weeks of the theft, Lazarus had laundered the majority of the stolen assets through a sophisticated network designed to obscure the money trail. According to TRM Labs, the attackers dispersed the stolen Ethereum across thousands of blockchain addresses, converted portions to Bitcoin and other virtual assets, and routed funds through crypto mixers, cross-chain bridges, and underground OTC brokers.

The FBI issued an alert urging exchanges, bridges, and blockchain analytics firms to block transactions from addresses associated with the theft. Despite these efforts, the speed and sophistication of the laundering operation outpaced most intervention attempts.

North Korea’s Crypto War Machine

The Bybit heist did not occur in isolation. According to NBC News, North Korean hackers stole at least $2.02 billion in cryptocurrency throughout 2025 — a 51% increase over the previous year. The Bybit hack alone accounted for roughly three-quarters of that total. Chainalysis reported that total cryptocurrency theft across all actors reached $3.4 billion in 2025, meaning North Korea was responsible for approximately 60% of all crypto stolen globally.

The United Nations and private researchers have long documented how Pyongyang uses cryptocurrency theft to circumvent international sanctions and fund its weapons of mass destruction programs. The Wilson Center notes that the scale of the Bybit heist alone exceeds the annual GDP of many small nations, making state-sponsored cryptocurrency theft one of North Korea’s most significant revenue streams.

Lessons for the Industry

The Bybit hack crystallizes several uncomfortable truths for the cryptocurrency industry. First, the weakest link was not the blockchain or the smart contract — it was a developer’s laptop. Supply chain attacks targeting the human layer of infrastructure have become the dominant threat vector, surpassing protocol-level exploits.

Second, multi-signature wallets provide security against private key theft but offer no defense when the signing interface itself is compromised. Bybit’s cold wallet required multiple approvals, but the malicious code manipulated what signers saw, making the fraudulent transaction appear legitimate.

Third, the speed of laundering has outpaced the industry’s ability to freeze stolen funds. Despite coordinated efforts by exchanges and analytics firms, the majority of the $1.5 billion was effectively laundered within weeks.

Sources & Further Reading

• North Korea Responsible for $1.5 Billion Bybit Hack — FBI
• In-Depth Technical Analysis of the Bybit Hack — NCC Group
• The Bybit Hack: Following North Korea’s Largest Exploit — TRM Labs
• Lazarus Hacked Bybit via Breached Safe{Wallet} Developer Machine — BleepingComputer
• The Bybit Heist: What Happened and What Now — Wilson Center
• Hackers Steal $1.5 Billion from Bybit — CNBC