North Korea's Lazarus Group Strikes Again: $1.46 Billion Crypto Heist

Generated by AI AgentCoin World
Sunday, Feb 23, 2025 5:38 am ET1min read
ETH
--

The North Korean Lazarus Group is suspected to be behind the recent $1.46 billion hack on the Bybit cryptocurrency exchange, according to blockchain analysis firm Arkham Intelligence. The hack, which involved the withdrawal of Ethereum tokens, is believed to be the largest ever on a centralized crypto exchange.

Arkham Intelligence offered a bounty of 50,000 ARKM tokens, worth around $30,000, for anyone who could identify the attackers responsible for the hack. Freelancer ZachXBT provided "definite proof" that the North Korean hacking group was behind the attack, leading to the conclusion that Lazarus, North Korea's elite state-sponsored hacking group, was responsible.

The attackers first withdrew the funds into a single wallet and then distributed them to multiple wallets. According to Nansen, a blockchain firm, the stolen funds were initially transferred to a primary wallet, which then distributed them across more than 40 wallets. The attackers converted all stETH, cmETH, and mETH to ETH before systematically transferring ETH in $27 million increments to over 10 additional wallets.

Bybit CEO Ben Zhou urged customers to remain calm and assured them that 80% of the funds were recovered by using bridge loans to replace the stolen money. Despite the current bank run on Bybit, Zhou assured users that withdrawals would not be blocked and that customers would have access to their funds.

ZachXBT has yet to release all data pointing to the Lazarus group. His analysis involved tracking online connections between wallet addresses until, with the assistance of a colleague, he was able to narrow down the suspects to the North Korean hacking group. ZachXBT found a connection between the wallets used in the Bybit hack and the wallets used in the $85 million hack of Singapore-based exchange Phemex.

The attack appears to have been caused by Blind Signing, in which the smart contract is approved without complete knowledge of its contents. This attack vector is quickly becoming the favorite form of cyber attack used by advanced threat actors, including North Korea. It's the same type of attack that was used in the Radiant Capital breach and the WazirX incident.

The stolen funds are unlikely to be returned because North Korea does not have an extradition agreement with the United States. The North Korean hacking group