Bybit

lazarus.day

On February 21, 2025, ByBit suffered the largest crypto hack in history, losing $1.43 billion. Attackers used a sophisticated front-end spoofing attack to deceive multisig signers into approving malicious transactions. The theft involved over 401,000 ETH and other assets, with funds quickly dispersed across multiple addresses. Security analysts linked the attack to North Korea’s Lazarus Group. Despite the massive loss, ByBit assured users that their funds were safe and that the exchange remained solvent.

lazarus.day

Safe{Wallet} and external analyses described the Bybit incident as a targeted Lazarus/TraderTraitor attack in which a compromised Safe{Wallet} developer environment enabled malicious front-end code to alter a multisig transaction proposal. The injected JavaScript on Safe{Wallet}'s AWS S3-hosted front end showed signers the expected address while replacing the actual transaction data, causing a Bybit Safe wallet owner to authorize a transaction that redirected control and funds to the attacker before the code was quickly removed.

CSIS Significant Cyber Incidents

North Korean hackers stole $1.5 billion in Ethereum from the Dubai-based exchange ByBit. Attackers exploited a vulnerability in third-party wallet software during a fund transfer, laundering at least $160 million within the first 48 hours of the attack. It is the largest cryptocurrency heist to date.

ThaiCERT Threat Group Cards

North Korean hackers linked to $1.5 billion ByBit crypto heist https://www.bleepingcomputer.com/news/security/north-korean-hackers-linked-to-15-billion-bybit-crypto-heist/ https://therecord.media/north-koreans-initial-laundering-bybit-hack

tayvano/lazarus-bluenoroff-research

Amt Stolen: $1,500,000,000

Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025

Table 3: DPRK Cryptocurrency Thefts, January - September, 2025. Date: 2025-02-21; Victim: ByBit; DPRK APT: TraderTraitor; Amount ($ Million): 1460. Report: "In coordination with Chainalysis and Mandiant, MSMT Participating States have attributed the cryptocurrency heists in tables 2 and 3 to DPRK actors."

FBI IC3 PSA 250226 (2025-02-26)

The Federal Bureau of Investigation (FBI) is releasing this PSA to advise the Democratic People's Republic of Korea (North Korea) was responsible for the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange, Bybit, on or about February 21, 2025. FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor."

Rekt News leaderboard (rekt.news/leaderboard)

Excerpt: $1.43B heist on ByBit claims the throne on our Rekt Leaderboard! Lazarus pulled off the perfect digital sleight-of-hand, making multisig signers see legitimate transactions while signing away the keys to the kingdom. Now ByBit's offering $140M to catch the hackers. | Article date: 2/22/2025

Germany BfV brochure Cyberangriffe – Gefahren, Risiken und Schutz vor staatlich gesteuerten Attacken (Februar 2026)

Im Februar 2025 wurde die Kryptobörse Bybit kompromittiert und Kryptowährung im Wert von über 1,4 Milliarden US-Dollar erbeutet. Es handelt sich um den bisher größten Diebstahl von Kryptowährung weltweit. Der Angriff geht auf nordkoreanische Cyberakteure zurück.

Netherlands NCTV Cybersecuritybeeld Nederland 2025 (CSBN 2025; with AIVD/MIVD input)

Opvallend deze periode was de cyber - aanval op ByBit. Daarbij maakte, naar verluidt Noord-Koreaanse, (staats)hackers bijna 1,5 miljard dollar aan digitale valuta buit. Dit is tot op heden de grootste cryptodiefstal ooit.

Check Point Research

Check Point Research covers the recent ByBit hack, one of the largest thefts in digital asset history, its implications for crypto security, and security recommendations. In this event, hackers gained access to an offline Ethereum wallet and stole $1.5 billion worth of digital assets. The attack occurred during a routine transfer from an offline cold wallet to a warm wallet, where attackers manipulated the transaction to divert funds to an unknown address. Blockchain analytics firms have attributed the heist to North Korea’s Lazarus Group.

US court filing via CourtListener RECAP: KIM v. RAILGUN DAO

And on February 21, 2025, North Korean hackers stole a record-breaking $1.5 billion worth of crypto assets. ... In February and early March of 2025, after having transferred the initial stolen assets several times between several purchasers, North Korea used Railgun DAO's crypto mixing service to launder $1,733,062 worth of crypto assets. [Case No. 1:26-cv-00179, U.S. District Court for the District of Columbia; filing: COMPLAINT against All Defendants with Jury Demand]

US court filing via CourtListener RECAP: BYBIT TECHNOLOGY LIMITED v. DEMOCRATIC PEOPLE'S REPUBLIC OF KOREA

The intrusion that culminated in the February 21, 2025 theft began on or about February 4, 2025, when Lazarus Group hackers compromised the workstation of a software developer at Safe{Wallet}—the third-party platform Bybit relied on to manage its multisig cold-wallet transactions—through a social-engineering attack. ... the hackers used the backdoors to drain $1.5 billion in Ethereum and Ethereum-based digital assets from Bybit's wallet [Case No. 1:26-cv-02173, U.S. District Court for the District of Columbia; filing: COMPLAINT against DEMOCRATIC PEOPLE'S REPUBLIC OF KOREA, DPRK RECONNAISSANCE GENERAL BUREAU, JOHN DOES 1-20, LAZARUS GRO]

US court filing via CourtListener RECAP: United States v. Approximately 21.17 BTC seized from address 3JB9jkioXqmKS9AbGZFhFyVPPR35Pla43x

investigators identified more than 40 deposits of virtual currency into MEHRAN's various Binance accounts worth approximately $1,916,219.80 (as of the date of the funds were seized) that represent the proceeds of illicit DPRK revenue generation schemes during the same timeframe. This includes funds from SIM, a sanctioned North Korean banker, and others that were recently indicted in U.S. v. Wang, et al. ... It also includes funds traced back to the North Korean cyber-attack perpetuated on Bybit. [Case No. 1:26-cv-13515, U.S. District Court for the District of Massachusetts; filing: COMPLAINT against All Defendants]

US court filing via CourtListener RECAP: United States v. Approximately 21.17 BTC seized from address 3JB9jkioXqmKS9AbGZFhFyVPPR35Pla43x

Law enforcement has associated the address bc1qp9h with a February 21, 2025, North Korean cyber-attack that stole approximately $1.5 billion in ETH and other virtual currencies from UAE-based virtual currency exchange Bybit. [Case No. 1:26-cv-13515, U.S. District Court for the District of Massachusetts; filing: COMPLAINT against All Defendants]

Elliptic blog: Bybit hack largest in history

On February 21, 2025, approximately $1.46 billion in cryptoassets were stolen from Bybit, a Dubai-based exchange. ... Elliptic has attributed the Bybit theft to North Korea, based on various factors, including our analysis of the laundering of the stolen cryptoassets.

Chainalysis blog: Collaboration in the Wake of Record-Breaking Bybit Theft

Funds from the Bybit exploit have also consolidated in addresses holding funds from other known DPRK-linked attacks, providing further evidence that the nation state actors are behind this latest incident.

TRM Labs blog: TRM Links North Korea to Record $1.5 Billion Record Hack

TRM has determined - with high confidence - that the Bybit hack was perpetrated by North Korean hackers.

TRM Labs blog: The Bybit Hack: Following North Korea's Largest Exploit

On February 26, 2025, the FBI officially linked the heist to North Korea.

ZachXBT Telegram channel t.me/investigations (public web view)

Lazarus Group transferred 5K ETH from the Bybit Hack to a new address and began laundering funds via eXch (a centralized mixer) and bridging funds to Bitcoin via Chainflip.

ZachXBT Telegram channel t.me/investigations (public web view)

after laundering $35M+ for Lazarus Group from the Bybit hack today.

Halborn blog: Explained: The Bybit Hack Revisited

The Lazarus Group exploited the exchange to steal an estimated $1.4 billion in ETH and ERC-20 tokens from one of the exchange's cold wallets.

FBI PSA I-022625-PSA "North Korea Responsible for $1.5 Billion Bybit Hack" (2025-02-26)

The Federal Bureau of Investigation (FBI) is releasing this PSA to advise the Democratic People's Republic of Korea (North Korea) was responsible for the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange, Bybit, on or about February 21, 2025.

Hackmageddon cyber attacks timelines (Paolo Passeri)

Cryptocurrency exchange Bybit reveals that a "sophisticated" attack led to the theft of over $1.5 billion worth of cryptocurrency from one of its Ethereum cold (offline) wallets, making it the largest ever single crypto heist in history. [Date Occurred: 21/02/2025; Date Discovered: 21/02/2025]

KISA cyber threat trend report, 2025 H1 (2025년 상반기 사이버 위협 동향 보고서)

먼저, 글로벌 가상자산 거래소 바이비트는 2월 21일 해킹 공격을 받아 약 15억 달러(한화 약 2조 700억 원) 규모의 가상자산을 도난당했다. 이는 거래소 침해사고 사상 최대 규모의 피해 사례로 기록되었으며, 현재까지 악용된 지갑 주소 정보 등으로 보아 공격 주체는 국가 배후 해킹그룹인 라자루스가 관련된 것으로 확인됐다. 조사결과 공격자는 거래소에서 이용 중인 지갑 보안 솔루션 회사(Safe Wallet)의 개발자 PC를 해킹 한 뒤, 지갑 운영 서비스에 바이비트의 가상자산 거래를 변조하는 자바스크립트 코드를 삽입하였다. 이를 통해 바이비트 관리자가 거래소의 콜드웰렛(오프라인 보관) 자산을 핫월렛(온라인 보관)으로 옮길 시, 핫월렛 주소를 공격자의 지갑 주소로 변경하는 방법으로 가상자산을 탈취하였다. [KISA report, page 9]

Bloomberg Technoz (bloombergtechnoz.com)

attribution sentence(s): Bloomberg Technoz, Jakarta - Para peneliti keamanan menduga bahwa kelompok peretas yang disponsori negara Korea Utara, Lazarus Group, berada di balik pencurian kripto terbesar pada bursa mata uang kripto ByBit. | Dengan transaksi kripto yang tercatat secara publik di blockchain, para peneliti dapat melacak aliran dana dan menemukan pola yang mengarah pada Lazarus Group. | Mengutip dari Gizmodo, Rabu (26/2/2025) sebagian besar dana yang dicuri dari ByBit dicampur dengan hasil pencurian lain yang telah dikaitkan dengan kelompok peretas asal Korea Utara tersebut.

Boannews 보안뉴스 (boannews.com)

attribution sentence(s): 암호화폐 전문가들, 공격패턴 유사 北 해킹조직 ‘라자루스’ 지목 | 이번 사건 배후로 북한 해킹 조직 ‘라자루스’가 지목됐다. | 해킹 배후로 북한 해킹그룹 라자루스가 지목됐다.

Dan Tri (dantri.com.vn)

attribution sentence(s): (Dân trí) - Các nhà nghiên cứu bảo mật đã phát hiện những bằng chứng cho thấy nhiều khả năng các nhóm tin tặc đến từ Triều Tiên là thủ phạm đứng sau vụ cướp 1,46 tỷ USD từ sàn giao dịch tiền điện tử Bybit. | Nhà nghiên cứu bảo mật blockchain ZachXBT cho biết đã phát hiện những dấu hiệu cho thấy Lazarus, nhóm tin tặc nổi tiếng đến từ Triều Tiên, là thủ phạm đứng sau vụ tấn công vào sàn tiền điện tử Bybit hôm 22/2 vừa qua. | ZachXBT cho biết, sau khi tin tặc lấy cắp lượng tiền số trị giá hơn 1,46 tỷ USD, một lượng lớn tiền số Ethereum đang được chuyển đến các ví tiền số từng được Lazarus sử dụng để rửa tiền từ các sàn giao dịch khác, bao gồm Poloniex, BingX và Phemex.

Dan Tri (dantri.com.vn)

attribution sentence(s): Cục Điều tra Liên bang (FBI) đã khẳng định Lazarus, nhóm tin tặc mà FBI tin rằng có sự hậu thuẫn của chính phủ Triều Tiên, chính là thủ phạm đã tấn công vào sàn giao dịch Bybit và lấy cắp lượng tiền điện tử trị giá hơn 1,46 tỷ USD vào ngày 22/2 vừa qua. | Trước đó, các công ty nghiên cứu bảo mật khác như TRM Labs và Elliptic cũng đã nghi ngờ nhóm tin tặc nổi tiếng của Triều Tiên Lazarus là thủ phạm tấn công Bybit, sau khi phát hiện một lượng lớn tiền điện tử lấy từ Bybit được chuyển đến các ví tiền số từng được Lazarus sử dụng để rửa tiền. | FBI khẳng định nhóm tin tặc khét tiếng của Triều Tiên Lazarus chính là thủ phạm đứng sau vụ trộm tiền điện tử lớn nhất lịch sử (Ảnh minh họa: Getty).

Detik (detik.com)

attribution sentence(s): Ilustrasi peretas dengan latar bendera Korea Utara. | Para peretas yang diduga bekerja untuk rezim Korea Utara berhasil menguangkan setidaknya US$300 juta (sekitar Rp4,9 triliun) dari hasil perampokan kripto sebesar US$1,5 miliar (Rp24,6 triliun). | Para bandit yang dikenal sebagai Kelompok Lazarus ini menggondol sejumlah besar token digital dalam peretasan bursa kripto ByBit sekitar dua minggu lalu.

Developpez.com (developpez.com)

attribution sentence(s): Le FBI accuse des pirates nord-coréens d'être à l'origine du vol de 1,5 milliard $ de cryptomonnaies contre Bybit, le groupe Lazarus serait responsable du "plus grand vol de cryptomonnaie de l'histoire" | Le groupe Lazarus serait responsable du "plus grand vol de cryptomonnaie de l'histoire" | Il s'agirait du plus grand vol numérique de tous les temps, dont le collectif de pirates informatiques Lazarus serait à l'origine.

Hankyung 한국경제 (hankyung.com)

attribution sentence(s): 암호화폐 역사상 최악의 해킹으로 꼽히는 이번 사건은 북한 해킹 조직의 소행일 가능성이 제기됐다. | 아캄 인텔리전스는 잭엑스비티가 북한 해킹 조직 라자루스 소행이라는 증거를 제출했다고 밝혔다. | 바이비트의 조사를 돕고 있는 블록체인 보안 기업 파이어블록스도 "이번 해킹은 지난해 발생한 인도 암호화폐 거래소 와지르X와 대출 프로토콜 라디언트 캐피털에 대한 공격과 유사한 것으로 보인다"며 "두 사건 모두 북한 소행이었다"고 설명했다.

Kompas TV (kompas.tv)

attribution sentence(s): Lazarus Group, yang merupakan kelompok hacker yang didukung Korea Utara diduga berada di balik pencurian tersebut. | Pakar keamanan Blockchain telah mengidentifikasi Lazarus Group, organisasi peretasan di bawah Biro Umum Pengintaian Korut, sebagai kemungkinan pelakunya. | Analis Blockchain ZachXBT mengatakan ia telah memberikan bukti yang menghubungkan serangan itu dengan Lazarus, dengan mengutip pola konsisten dengan serangan siber Korea Utara baru-baru ini.

La Nación (Argentina) (lanacion.com.ar)

attribution sentence(s): El grupo Lazarus, largamente vinculado con el régimen norcoreano, sería el responsable del hackeo de Bybit a principios de febrero | El FBI ha acusado a hackers vinculados con Corea del Norte de llevar a cabo uno de los mayores robos conocidos de criptomonedas, apoderándose de unos 1500 millones de dólares en ethereum de una empresa con sede en Dubái. | El robo, ocurrido a principios de este mes y dirigido contra Bybit, una de las mayores plataformas de intercambio de criptomonedas del mundo, era otro incidente que involucra a un equipo de hackers identificados por el gobierno de Estados Unidos con los nombres de TraderTraitor y grupo Lazarus.

Meduza (meduza.io)

attribution sentence(s): Хакеры из КНДР украли почти полтора миллиарда долларов у криптобиржи Bybit. | На следующий день после ограбления пользователь с ником ZachXBT, который специализируется на расследованиях, связанных с криптовалютой, нашел доказательства, что за взломом Bybit стоят хакеры из северокорейской группировки Lazarus Group. | Причастность Lazarus Group подтвердили и специалисты аналитической компании Elliptic.

Money Today 머니투데이 (mt.co.kr)

attribution sentence(s): 세계 최대 가상자산(암호화폐) 거래소 중 한 곳이 북한 해킹 조직의 소행일 것으로 추정되는 해킹으로 2조원 이상의 피해를 본 것으로 나타났다. | 블록체인 분석가 잭엑스비티와 블록체인 데이터 추적 플랫폼 아캄 인텔리전스는 14억달러 이상의 자산이 의심스러운 거래를 통해 유출되고 있다며 이번 사건의 배후를 북한 해킹 조직 '라자루스'로 지목했다. | 라자루스는 가상자산 산업에서 수십억 달러를 빼돌린 것으로 악명 높은 해킹 조직이다.

Periodista Digital (periodistadigital.com)

attribution sentence(s): El grupo Lazarus golpea de nuevo al exchange ByBit | Los hackers del grupo Lazarus, vinculados al régimen norcoreano, han logrado convertir al menos 300 millones de euros de su monumental robo de 1.500 millones de euros en criptomonedas. | Lazarus manipuló una transferencia rutinaria en una cartera fría de ByBit, redirigiendo más de 401.000 Ethereum a direcciones bajo su control.

RB.ru (rb.ru)

attribution sentence(s): По одной из версий, за атакой стоит знаменитая Lazarus Group | Аналитическая компания Arkham Intelligence заявила, что за взломом криптобиржи Bybit на $1,5 млрд стоит хакерская группировка Lazarus Group из КНДР. | «[Анонимный интернет-детектив] ZachXBT предоставил неопровержимые доказательства того, что атака на Bybit была осуществлена Lazarus Group», — написала Arkham Intelligence в своем X-аккаунте.

Secrss 安全内参 (secrss.com)

attribution sentence(s): 事件发生后，慢雾第一时间通过攻击者获取 Safe 多签的手法以及洗币手法推测攻击者为朝鲜黑客： | ZachXBT 也实锤了本次攻击与朝鲜黑客组织 Lazarus Group 有关，该组织一直以实施跨国网络攻击和盗窃加密货币为主要活动之一。据了解，ZachXBT 提供的证据，包括测试交易、关联钱包、取证图表及时间分析等，都显示了攻击者在多次操作中使用了 Lazarus Group 常见的技术手段。同时，Arkham 表示，所有相关数据已经分享给 Bybit，帮助平台进一步展开调查。 | 在本次事件中，Safe 合约没问题，问题在非合约部分，前端被篡改伪造达到欺骗效果。这个不是个案。朝鲜黑客去年就以此方式攻击了好几个平台，如：WazirX 损失 $230M，为 Safe 多签；Radiant Capital 损失 $50M，为 Safe 多签；DMM Bitcoin 损失 $305M，为 Gonco 多签。这种攻击手法工程化成熟，需要多加注意。

Secrss 安全内参 (secrss.com)

attribution sentence(s): Bybit首席执行官Ben Zhou称，黑客控制了公司一个未联网的“冷钱包”，将资金转移至未知地址；区块链情报平台Arkham援引ZachXBT提供的信息称，朝鲜黑客组织拉撒路集团是这起事件的幕后黑手；这是迄今为止最大的加密货币盗窃案，超越了此前Ronin Network和Poly Network的黑客事件，分别损失6.24亿美元和6.11亿美元。 | 调查：2024年朝鲜黑客窃取了价值近百亿元的加密货币 | 区块链情报平台Arkham后续援引ZachXBT提供的信息称，朝鲜黑客组织拉撒路集团（Lazarus Group）是这起事件的幕后黑手。Arkham在X平台发布消息称：“21日19:09（UTC），ZachXBT提交了确凿证据，表明此次对Bybit的攻击由拉撒路集团实施。他提供的材料包括对攻击前测试交易及相关钱包的详细分析，并附有多张取证分析图和时间序列分析。这些信息已分享给Bybit团队，以协助他们的调查。”

Sina Finance 新浪财经 (finance.sina.com.cn)

attribution sentence(s): Coinbase 主管 Conor Grogan 表示，朝鲜对 Bybit 的黑客攻击是有史以来最大的黑客盗窃案（高于伊拉克中央银行盗窃案，价值约 10 亿美元）其金额约为 2016 年 DAO 黑客攻击的 10 倍（但供应量的百分比要高得多）预计这里会出现一些要求以太坊分叉的呼声。（此处金额以被盗时的价值计算） | Arkham 发推表示，链上分析师 ZachXBT 提供了确凿证据，证明 Bybit 的 15 亿美元黑客攻击由朝鲜支持的黑客组织 Lazarus Group 实施。他的提交包括对测试交易、关联钱包、取证图表和时间分析的详细分析。相关信息已分享给 Bybit，以协助其调查。 | Safe 的安全团队回应称，正在与 Bybit 紧密合作，进行持续调查。目前尚未发现官方 Safe 前端被攻破的证据，但出于谨慎考虑，Safe Wallet 暂时暂停某些功能。慢雾余弦表示，类似此前 Radiant Capital 案例，可能也是遭到朝鲜黑客盗窃。Radiant Capital 表示，其 10 月份遭遇的一起价值 5000 万美元的攻击事件与朝鲜黑客组织有关，该事件涉及复杂的身份伪造和多层次的网络钓鱼攻击。攻击者冒充为前承包商，通过社会工程手段获取敏感凭证，从而入侵协议系统实施攻击。

TechTarget Japan (ITmedia) (techtarget.itmedia.co.jp)

attribution sentence(s): 暗号資産（仮想通貨）を狙った攻撃が盛んだ。北朝鮮系の攻撃集団「Lazarus Group」はこのほど、暗号資産取引所Bybit Technologyから15憶ドルを奪った。手口は何だったのか。 | 米連邦捜査局（FBI）によると、2025年2月、北朝鮮の政府が支援しているとみられるサイバー犯罪集団「Lazarus Group」が、暗号資産（仮想通貨）取引所を運営するBybit Technologyから15億ドル（約2220億円）相当を奪った。Lazarus Groupはどのようなサイバー犯罪集団なのか。そして今回の攻撃の手口とは。 | 暗号資産にどん欲なLazarus　こうやって盗む

Tencent News 腾讯新闻 (news.qq.com)

attribution sentence(s): Coinbase 主管 Conor Grogan 表示，朝鲜对 Bybit 的黑客攻击是有史以来最大的黑客盗窃案（高于伊拉克中央银行盗窃案，价值约 10 亿美元）其金额约为 2016 年 DAO 黑客攻击的 10 倍（但供应量的百分比要高得多）预计这里会出现一些要求以太坊分叉的呼声。（此处金额以被盗时的价值计算） | Arkham 发推表示，链上分析师 ZachXBT 提供了确凿证据，证明 Bybit 的 15 亿美元黑客攻击由朝鲜支持的黑客组织 Lazarus Group 实施。他的提交包括对测试交易、关联钱包、取证图表和时间分析的详细分析。相关信息已分享给 Bybit，以协助其调查。 | Safe 的安全团队回应称，正在与 Bybit 紧密合作，进行持续调查。目前尚未发现官方 Safe 前端被攻破的证据，但出于谨慎考虑，Safe Wallet 暂时暂停某些功能。慢雾余弦表示，类似此前 Radiant Capital 案例，可能也是遭到朝鲜黑客盗窃。Radiant Capital 表示，其 10 月份遭遇的一起价值 5000 万美元的攻击事件与朝鲜黑客组织有关，该事件涉及复杂的身份伪造和多层次的网络钓鱼攻击。攻击者冒充为前承包商，通过社会工程手段获取敏感凭证，从而入侵协议系统实施攻击。

Tencent News 腾讯新闻 (news.qq.com)

attribution sentence(s): 根据10x Research统计数据，此次 Bybit 交易所被盗的 14.6 亿美元是加密交易所历史上规模最大的黑客攻击事件，第二大加密盗窃案是 2021 年Poly Network的 6.11 亿美元。此外，链上侦探 ZachXBT 已提交确凿证据，确认朝鲜黑客组织 Lazarus Group 是此次攻击的幕后黑手。 | 然而，Safe 的解释并未完全消除行业的疑虑。区块链安全公司 Blockaid首席执行官 Ido Ben Natan 指出，“盲签”技术正迅速成为高级威胁行为者（如朝鲜黑客）最喜欢的攻击形式。此次攻击与 2023 年 12 月的 Radiant Capital 入侵事件和 2024 年 3 月的 WazirX 事件中使用的攻击类型相同。Natan 强调，即使有最好的密钥管理解决方案，签名过程仍依赖于与 dApp 交互的软件接口，这为恶意操纵签名过程打开了大门。

Tencent News 腾讯新闻 (news.qq.com)

attribution sentence(s): 在上次 AMA 中，围绕是不是潜在 APT 高级渗透攻击和@benbybit 老板进行了简单沟通，并没有明确定论是不是针对内部的渗透攻击。但如果调查结果是，按照慢雾最新的报告来看，朝鲜黑客组织 Lazarus Group 面向交易所的精密 APT 渗透攻击是如何实现的？以下，简单科普下逻辑： | Lazarus APT 高级持续性渗透攻击原理，通俗版本：

VOA Korean (voakorea.com)

attribution sentence(s): 사상 최대 규모인 15억 달러 상당의 암호화폐를 탈취당한 거래소 바이비트가 북한 해킹 조직 라자루스를 범죄의 배후로 지목했습니다. | 라자루스 추적에 현상금을 내걸고, 완전히 근절될 때까지 멈추지 않을 것이라고 밝혔습니다. | 지난 21일 해킹 공격으로 거액의 가상자산을 탈취당한 암호화폐 거래소 ‘바이비트(Bybit)’가 북한 해킹 조직 라자루스와의 ‘전쟁’을 선포하며 자금 추적에 나섰습니다.

VOA Korean (voakorea.com)

attribution sentence(s): 북한 연계 해킹조직 라자루스가 정상적인 가상화폐 거래로 위장해 바이비트 임원들의 승인을 받아내는 수법으로 15억 달러 규모의 가상자산을 탈취한 것으로 최근 밝혀졌습니다. | 바이비트 측은 북한이 미국을 공격하기 위해 미사일을 발사할 필요가 없었다며, 미국의 기술 인프라를 이용한 사이버 공격의 위험성을 지적했습니다. | 북한 연계 해킹조직 라자루스 그룹은 가상화폐 거래소 ‘바이비트’가 가상자산을 안전하게 보관하는 오프라인 계좌, 이른바 ‘콜드월렛’에서 다른 계좌로 자산을 옮기는 정상적인 내부 거래를 공격의 기회로 삼았습니다.

pennmike.com (pennmike.com)

attribution sentence(s): 가상화폐 역사상 최악의 해킹 사건으로 기록될 이번 공격은 북한 해킹 조직 ‘라자루스(Lazarus)’의 소행일 가능성이 제기되고 있다. | ▲북한 해커 조직 라자루스 개입 가능성 | 바이비트 해킹과 관련해, 북한 해커 조직 라자루스의 소행 가능성이 제기되고 있다.

Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025

(MSMT/2025/2, report p. 31) “In February 2025, DPRK actors associated with TraderTraitor stole nearly $1.5 billion in virtual assets from Bybit ... DPRK actors associated with TraderTraitor obtained unauthorized access to Safe{Wallet} by targeting one of its developers with spear phishing emails in early February 2025. ... To execute the attack on February 21, the DPRK actors leveraged access to the AWS account to manipulate Safe{Wallet}’s front-end user interface by injecting malicious JavaScript code. ... at least one other DPRK actor group also researched vulnerabilities for manipulating Safe{Wallet}’s front-end prior to the heist”. (Table 3 lists ByBit, 2025-02-21, 1460 $ Million.)

Elastic Security Labs

A high-fidelity emulation of the DPRK's largest cryptocurrency heist via a compromised macOS developer and AWS pivots.

NSFOCUS (nsfocusglobal.com)

Event Summary In February 2025, the North Korea-linked APT group Lazarus launched a highly sophisticated supply chain attack against the prominent cryptocurrency exchange Bybit, successfully stealing over 400,000 ETH and stETH—valued at approximately $1.5 billion. This incident marks the largest single security breach in the global cryptocurrency sector to date. The attack exposed critical vulnerabilities […] The post Top Security Incidents of 2025: Lazarus Group’s Cryptocurrency Heist appeared first on NSFOCUS .

Socket.dev blog

Bybit's $1.46B hack by North Korea's Lazarus Group pushes 2025 crypto losses to $1.6B in just two months, already surpassing all of 2024's $1.49B total.

Validin blog

On March 6, 2025, Safe{Wallet} published an investigation update and a call to action regarding the recent $1+ billion Bybit Hack that was attributed by the FBI to North Korea’s Lazarus Group (aka UNC4899 ).

Recorded Future Insikt Group

On May 5, 2025, Elastic Security Labs published a report detailing how DPRK-linked TraderTraitor operators stole roughly 400,000 ETH from ByBit by abusing Safe{Wallet}’s AWS authentication.

NCC Group

On 21 st February 2025, Bybit suffered the largest cryptocurrency theft ever recorded, with more than $1.4 billion assets, including 401,347 ETH, drained from its cold wallet. ... From these movements @ZachXBT was able to prove that this attack was performed by Lazarus, a North-Korea state-sponsored group.

The attacker transferred about 400,000 ETH, worth approximately $1.5 billion, from Bybit's cold wallet on February 21, 2025, then removed the injected payload.

The malicious interface swapped a routine transfer for a delegatecall that upgraded the Safe implementation and enabled the theft of about $1.4 billion in ETH.