FBI says North Korean Lazarus hackers were behind $1.5 billion Bybit crypto hack

(Image credit: Shutterstock)

Bybit recently saw $1.5 billion stolen during a routine transfer
The FBI has now linked the Lazarus Group to the theft
The funds are currently being laundered to hamper tracing efforts

The Bybit cryptocurrency theft which saw almost $1.5 billion in funds stolen, has now been attributed to the notorious North Korean Lazarus Group by the FBI.

The Lazarus Group is also tracked as TraderTraitor and APT38, and in a statement, the FBI said, “TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets to Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains. It is expected these assets will be further laundered and eventually converted to fiat currency.”

The funds were part of a regular transfer of Ethereum cryptocurrency between Bybit’s cold and hot wallet, but were redirected in transit to a Lazarus Group controlled blockchain address marking the largest cryptocurrency theft in history.

Largest crypto theft in history

The FBI also listed multiple Ethereum addresses linked to the theft, and requested that platforms who handle the transfer of cryptocurrency to block transactions from the listed accounts.

Bybit has also invited anyone with blockchain or cryptocurrency expertise to help track the stolen funds.

ZachXBT, a cryptocurrency theft and fraud investigator, observed the thieves transferring some of the stolen crypto to an Ethereum address previously used in several Lazarus Group operations.

Numerous other organizations in the blockchain industry have observed numerous transfers between North Korean controlled addresses in attempts to launder the funds and slow down tracing efforts.

The Lazarus Group has garnered quite a name for its crypto thefts that are believed to be a revenue generating method for the North Korean government.

North Korea does not disclose its GDP, but estimates place the country’s 2023 nominal GDP at USD$29.6 billion, meaning that the theft would account for around 5% of North Korea’s GDP in 2023.

These are the best firewalls around today
Take a look at the best antivirus to stay safe online
New Lazarus Group campaign sees North Korean hackers spreading undetectable malware through GitHub and open source packages

Benedict has been writing about security issues for over 7 years, first focusing on geopolitics and international relations while at the University of Buckingham. During this time he studied BA Politics with Journalism, for which he received a second-class honours (upper division), then continuing his studies at a postgraduate level, achieving a distinction in MA Security, Intelligence and Diplomacy. Upon joining TechRadar Pro as a Staff Writer, Benedict transitioned his focus towards cybersecurity, exploring state-sponsored threat actors, malware, social engineering, and national security. Benedict is also an expert on B2B security products, including firewalls, antivirus, endpoint security, and password management.