North Korea's Lazarus Group Pulls Off Largest Crypto Heist Ever

Crypto assets worth approximately $1.46 billion were stolen from the Dubai-based Bybit exchange on Feb. 21, marking the largest crypto heist to date. The theft was attributed to North Korea's Lazarus Group by blockchain security firm Elliptic. As the hackers continue to attempt to obfuscate the transaction trail, it is likely that the stolen funds will be laundered through mixers.

Elliptic reported that the Lazarus Group's laundering process typically follows a characteristic pattern, with the first step being the exchange of any stolen tokens for a native blockchain asset such as ETH. The second stage of laundering involves "layering" the stolen funds to conceal the transaction trail. This layering process can take many forms, including sending funds through large numbers of crypto wallets, moving funds to other chains using crosschain bridges, switching between different crypto assets using decentralized exchanges, and using mixers such as Tornado Cash.

Within two hours of the theft, the stolen funds were sent to 50 different wallets, each holding approximately 10,000 ETH. These wallets are now being systematically emptied, with at least 10% of the stolen assets having moved from these wallets. Elliptic reported that one service, in particular, had emerged as a major and willing facilitator of this laundering, refusing to block the activity despite direct requests from Bybit. The service, eXch, allows users to swap crypto assets anonymously.

Despite eXch's denial of involvement in laundering money for the North Korean hacking collective, Elliptic alleges that tens of millions of dollars worth of crypto assets stolen from Bybit have been exchanged using the service. The Lazarus Group has successfully laundered over $200 million worth of stolen crypto between 2020 and 2023, primarily using mixers and peer-to-peer (P2P) marketplaces.

In response to the hack, Bybit CEO Ben Zhou announced on Feb. 24 that the crypto exchange has fully replaced the $1.4 billion worth of Ether that was hacked. A new audited proof-of-reserve report will be published soon.