On May 9, 2025, Taiwan-based BitoPro suffered a cryptocurrency theft that forensic findings later said resembled Lazarus Group tradecraft. Attackers socially engineered a cloud operations employee, implanted malware, hijacked AWS session tokens to bypass MFA, reached the hot-wallet host during a wallet upgrade and asset-transfer window, and simulated legitimate transactions to move cryptocurrency.
BitoPro exchange links Lazarus hackers to $11 million crypto heist https://www.bleepingcomputer.com/news/security/bitopro-exchange-links-lazarus-hackers-to-11-million-crypto-heist/
Table 3: DPRK Cryptocurrency Thefts, January - September, 2025. Date: 2025-05-09; Victim: BitPro; DPRK APT: DPRK (Unidentified); Amount ($ Million): 12.3. Report: "In coordination with Chainalysis and Mandiant, MSMT Participating States have attributed the cryptocurrency heists in tables 2 and 3 to DPRK actors."
Description of the event: According to on-chain investigator ZachXBT, crypto exchange BitoPro was reportedly hacked on May 8, 2025, resulting in losses of approximately $11.5 million. The attacker drained assets from BitoPro’s hot wallets on Tron, Ethereum, Solana, and Polygon, then sold them via DEXs. The stolen funds were subsequently laundered through Tornado Cash or bridged via Thorchain to the Bitcoin network, eventually ending up in a Wasabi Wallet. BitoPro stated that the tactics used in this incident closely resemble those seen in several major international cases, attributing the attack to the North Korean hacking group Lazarus. | Amount of loss: $ 11,500,000 | Reference: https://x.com/zachxbt/status/1929417001296146868