Blockchain intelligence firm Arkham Intelligence confirmed that the North Korean state-backed Lazarus Group was behind the $1.46 billion Bybit hack on February 21, 2025. The finding came after blockchain investigator ZachXBT traced the stolen funds to wallets linked to earlier attacks.
Arkham had offered 50,000 ARKM tokens as a bounty for information about the attackers. ZachXBT submitted wallet links, test transactions, timing data, and other evidence. His work also linked the stolen funds to a separate attack on Phemex.
The FBI later formally attributed the theft to North Korea and called the activity TraderTraitor. The agency said the attackers were moving the stolen assets across thousands of blockchain addresses and warned that more laundering was expected.
BREAKING: BYBIT $1 BILLION HACK BOUNTY SOLVED BY ZACHXBT
At 19:09 UTC today, @zachxbt submitted definitive proof that this attack on Bybit was performed by the LAZARUS GROUP.
His submission included a detailed analysis of test transactions and connected wallets used ahead of the exploit, as well as multiple forensics graphs and timing analyses.
The submission has been shared with the Bybit team in support of their investigation. We wish them all the best.
— Arkham (@arkham) February 21, 2025
How the Bybit attack happened
Bybit said the attack targeted one Ethereum cold wallet used with Safe’s multisignature system. Attackers compromised a Safe developer’s credentials and used that access to change what signers saw when approving a transaction. Bybit’s later forensic review said its own systems were not compromised.
The stolen assets included about 401,347 ETH, along with staked Ether and other tokens. Bybit said the total loss was about $1.46 billion. The exchange said its client assets remained fully backed and that it could cover the loss.
ZachXBT’s analysis helped connect the attackers to the Phemex incident and other suspected Lazarus activity. The pattern of wallet movements was important because blockchain transactions are public, allowing investigators to follow funds even when attackers move them through many addresses.
Lazarus Group just connected the Bybit hack to the Phemex hack directly on-chain commingling funds from the intial theft address for both incidents.
Overlap address:
0x33d057af74779925c4b2e720a820387cb89f8f65Bybit hack txns on Feb 22, 2025:
0xc963e65b9ec39b11076f78990c31f29aaa80705c75312dafd1748479e3e94ed0
0x411374feedcfa560335f00c0fcfa0a3906fdcc33687e6f924dd78ebecc45cd00Phemex hack txns on Feb 20, 2025:
0x6262a3339842240aeebae4ebfe338dbc771aa0e2df8f5a1ebcd7f9b090bedfe3— ZachXBT (@zachxbt) February 22, 2025
The attack also showed that crypto security is not only about protecting private keys. Human error, fake screens, stolen developer access, and software used by signers can all become entry points. Some industry experts questioned Bybit’s first explanation, but later forensic work pointed to the Safe developer compromise as the main cause.
“this transaction was manipulated through a sophisticated attack that masked the signing interface”
For anyone curious, they are trying to confuse you instead of saying “The Bybit team members were linked to a phishing website and signed a malicious transaction”
And no matter how compromised your system is, double checking the wallet address *on your hardware wallet* should be standard practice when signing something for a wallet holding hundreds of millions (billions?) of dollars.
— tanz0rz (@tanz0rz) February 21, 2025
Also Read: Hackers Steal Over $768 Million in Record-Breaking September — CertiK
The hack changed how exchanges think about security
The scale of the theft made it the largest crypto hack on record. Chainalysis reported that North Korean hackers stole more than $1.3 billion in crypto during 2024. The Bybit attack showed how quickly those groups can move when they find a weakness in a major platform.
Bybit responded with a recovery program and worked with exchanges, blockchain firms, and other crypto companies to freeze or block stolen funds. The company later expanded its security systems to include real-time onchain monitoring and AI-assisted threat detection. Bybit said these tools helped intercept more than $700 million in potential user losses during the first half of 2026, although that figure is the company’s own claim.
In August 2026, Bybit also filed a U.S. lawsuit against North Korea, its Reconnaissance General Bureau, and the Lazarus Group. The exchange said a court issued a preliminary order to freeze identified stolen assets held by people or entities connected to the case.
The case also shows why old security models may not be enough for large crypto platforms. Safe later confirmed that its developer environment had been compromised, while Bybit said the exchange itself had not been breached.
The Lazarus Group remains a major threat to crypto companies, and the Bybit case is still being used as a lesson in wallet security, employee protection, transaction signing, and fund tracking. For exchanges, the challenge is no longer only stopping an attacker from entering. They must also detect suspicious actions before a signed transaction can move hundreds of millions of dollars.
While U.S. authorities have recovered assets from earlier cases such as the 2016 Bitfinex hack, the Bybit case shows how difficult recovery becomes once stolen crypto is split across many chains and wallets. South Korean authorities also identified Lazarus and Andariel in connection with the earlier Upbit attack.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights.
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
