Blockchain intelligence firm Arkham Intelligence has confirmed that the North Korean state-backed Lazarus Group is responsible for the massive $1.46 billion exploit of crypto exchange Bybit on February 21.
The revelation came after on-chain investigator ZachXBT successfully traced wallet connections leading back to the notorious hacker collective.
Arkham had offered a bounty of 50,000 ARKM tokens—valued at approximately $31,500—for any information leading to the identification of those behind the attack. In response, ZachXBT, a well-known blockchain sleuth, submitted a comprehensive analysis, detailing test transactions, wallet connections, forensic graphs, and timing patterns that linked the exploit to previous Lazarus Group operations.
According to Arkham, ZachXBT’s findings also uncovered links between the Bybit hack and a separate $85 million attack on Singapore-based crypto exchange Phemex last month. While the full details of his investigation have yet to be disclosed, the evidence strongly suggests that the same North Korean-affiliated cybercriminals were involved in both incidents.
The Lazarus Group, infamous for its highly sophisticated on-chain exploits, has been a dominant force in crypto-related cybercrime. Chainalysis data from last year revealed that North Korean hackers were responsible for stealing over $1.3 billion in 2024 alone—accounting for 61% of all crypto thefts that year. Unlike a singular entity, Lazarus operates as a network of specialized teams, employing tactics such as phishing scams, blockchain manipulation, and social engineering to infiltrate crypto platforms.
Bybit has described the exploit as a “sophisticated attack” that manipulated the signing interface of a multi-signature transaction, effectively disguising the hacker’s wallet as a legitimate recipient. However, some industry experts have questioned this explanation, speculating that the breach may have resulted from a phishing attack targeting Bybit employees.
While U.S. authorities have successfully recovered assets from past crypto hacks, such as the 2016 Bitfinex hack, Lazarus Group’s deep-rooted tactics and North Korea’s geopolitical standing make this case particularly challenging. Similarly, in November 2024, South Korean authorities identified North Korean hacker groups Lazarus and Andariel as responsible for the $50 million hack on local crypto exchange Upbit in 2019.
If you want to read more news articles like this, visit DeFi Planet and follow us on Twitter, LinkedIn, Facebook, Instagram, and CoinMarketCap Community.
“Take control of your crypto portfolio with MARKETS PRO, DeFi Planet’s suite of analytics tools.”
