FBI Attributes $1.5 Billion Bybit Theft to North Korea in Record-Breaking Crypto Heist

FBI identifies attack as "TraderTraitor" campaign

The Federal Bureau of Investigation released a Public Service Announcement naming the operation "TraderTraitor," describing it as a coordinated effort by North Korean state-backed cyber operatives targeting digital asset platforms. According to the bureau, "TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets to Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains."

Officials anticipate that the stolen funds will undergo money laundering before being converted into traditional government-issued currency not tied to physical commodities. The FBI distributed a compilation of Ethereum wallet addresses linked to the threat actors' laundering operations and urged cryptocurrency firms to prevent transactions involving these addresses.

Bybit breach details and company response

The theft occurred when attackers compromised a routine internal transfer from Bybit's Ethereum offline storage vault, according to company leadership Ben Zhou. Perpetrators exploited security gaps in the transaction process to penetrate the offline wallet and subsequently moved approximately 401,000 ETH to an unknown recipient. The incident triggered a roughly 4% decline in Ethereum's market value on Friday, bringing the per-unit price to $2,641.41.

This incident surpasses the 2022 Ronin Network breach, which resulted in the loss of $615 million in Ethereum and other digital currencies. The Bybit theft also exceeds the largest documented non-digital heist: Saddam Hussein's 2003 seizure of $1 billion from Iraq's central banking institution.

Zhou announced via X on Sunday that Bybit had restored its financial reserves through a combination of emergency financing arrangements and substantial capital infusions. Management assured customers that holdings remained protected and pledged reimbursement for any affected account holders.

Established in 2018, Bybit has attracted backing from prominent figures including U.S. President Donald Trump and former PayPal executive Peter Thiel during its early stages. The platform currently serves over 60 million customers globally and provides trading access to numerous digital currencies.

Lazarus Group identified as likely perpetrator

Security researchers specializing in blockchain technology have pinpointed the Lazarus Group, an organization operating under North Korea's Reconnaissance General Bureau, as the probable culprit. Blockchain investigator ZachXBT furnished analysis to the analytics firm Arkham connecting the incident to Lazarus, noting tactical similarities with recent North Korean cyber operations in research published by TRM Labs.

The Lazarus Group emerged around 2009 and has orchestrated numerous significant cyber incidents, notably the 2017 Wannacry ransomware campaign that compromised over 300,000 systems globally and severely disrupted operations at the United Kingdom's National Health Service. The NHS sustained approximately £92 million in losses stemming from healthcare service interruptions. The organization continues refining malware capabilities to evade security detection.

ZachXBT also connected the Bybit operation to a January breach targeting Phemex, a competing cryptocurrency platform that sustained losses exceeding $69 million, per reporting from The Record.

North Korean cyber units have repeatedly targeted cryptocurrency exchanges to acquire digital holdings, process illicit proceeds, and channel resources toward nuclear weapons development. During 2024, North Korean operatives acquired $1.3 billion in digital assets—nearly double the $660 million obtained during 2023.

Digital currencies have emerged as a favored vehicle for criminal organizations seeking to obscure the origins of unlawfully obtained money.