- Lazarus Group stole $1.4 billion from Bybit using test transactions and linked wallets in a major crypto hack.
- At least $200 million of stolen Ether has been sold on decentralized exchanges raising concerns about crypto security.
- Bybit CEO assured users that all client assets are backed and the exchange remains stable despite the massive loss.
The Lazarus Group, a hacking organization linked to North Korea, has been identified as responsible for the $1.4 billion Ethereum theft from Bybit. Blockchain investigator ZachXBT uncovered a series of test transactions and connected wallets leading directly to the hackers. His research was shared on X, including detailed graphs and time-based analysis to assist Bybit’s ongoing investigation.
Blockchain Investigators Confirm Attackers
Arkham Intelligence, a blockchain data platform, reviewed ZachXBT’s findings. They confirmed that the evidence strongly linked the attack to the Lazarus Group. To encourage further information, Arkham had offered a reward of 50,000 ARKM tokens. The attack occurred on Friday, with 401,346 ETH stolen from Bybit’s cold wallet. Despite cold wallets being offline for security reasons, the hackers managed to breach it.
Stolen Funds Tracked and Sold
Reports indicate that the stolen funds were transferred across multiple wallets. At least $200 million worth of staked Ether (stETH) has already been sold on decentralized exchanges. The event has raised concerns about the security of digital assets and the effectiveness of protective measures.
Following the hack, Bybit CEO Ben Zhou reassured users that the exchange remains financially stable. He confirmed that all client assets are fully backed. Despite the loss, Bybit continues to operate without disruptions. However, the attack has affected broader market confidence.
History of Crypto Thefts of the Group
The Lazarus Group has been responsible for several high-profile cryptocurrency hacks. In March 2022, they stole $625 million from the Ronin Network. They later siphoned off $100 million from Harmony’s Horizon bridge in June 2022. In 2024, they helped pull off the $300 million theft from Japan’s DMM Bitcoin exchange. Their methods keep evolving and they continue taking advantage of the weak spots in blockchain systems.
Earlier this year, the United States, Japan, and South Korea issued a joint statement on threats from North Korean hackers. Despite these efforts, these attacks are becoming more frequent and they emphasize the need for better security in the crypto space.
