Greek Authorities Freeze $1.5 Billion in Stolen Crypto from Bybit Hack

Greek authorities have taken a significant step in the ongoing investigation into the massive crypto heist from the Bybit exchange, which resulted in the loss of approximately $1.5 billion in ether. The Hellenic Anti-Money Laundering Authority (HAMLA) has frozen a crypto wallet containing funds traced back to the February hack, marking the first such intervention in the country. This move is part of a broader effort to combat digital financial crimes and follows intelligence received in May, which led to the identification of a user on a Greek trading platform who had received a substantial amount of ether.

HAMLA President Charalambos Vourliotis announced the development during a briefing with Greece’s Minister of Economy and Finance, Kyriakos Pierrakakis. The authority used specialized software to analyze the suspicious transaction and confirmed that the coins were part of the stolen funds from Bybit. Acting on a prosecutor’s order, the wallet was immediately frozen, and a seizure order for the crypto holdings was issued. A report was also submitted to the Prosecutor’s Office for further legal action.

The authorities have not yet disclosed details about the seized holdings or the recipient of the digital transfer. However, the local press has highlighted the significance of this move, noting that it is the first instance of Greece freezing illicit crypto funds and uncovering a local connection to a digital financial crime of this magnitude. The case has garnered international attention, with the U.S. Federal Bureau of Investigation (FBI) issuing a public alert confirming the freezing of suspicious digital assets.

The Dubai-based Bybit, a leading crypto exchange, announced the hack on February 21, 2025, reporting the theft of $1.5 billion in ETH, which is considered the largest cryptocurrency theft to date. Blockchain analysis has linked the attack to the Lazarus Group, a hacking syndicate allegedly controlled by the regime ruling North Korea. The group reportedly exploited security weaknesses and transferred the digital coins to multiple addresses.

HAMLA began investigating the Greek connection last month when it was notified of a suspicious movement of funds, specifically the crediting of a large sum of Ethereum to a wallet hosted by an unnamed provider of crypto exchange services in Greece. Using blockchain forensics tools, the agency’s analysts conducted a series of checks to trace the transaction trail, which led them to one of the ETH wallets involved in the laundering of the Bybit funds. The funds had been split and moved through multiple wallets before some of it ended up in Greece.

Investigators have not yet determined whether the Greek owner of the frozen wallet was aware of the true origin of the funds received. However, law enforcement officials are considering all scenarios, including the possibility that the person acted as an intermediary link in a global digital money laundering scheme. This development underscores the growing complexity of digital financial crimes and the need for international cooperation to combat such activities.