North Korea-Linked Hackers Steal US$1.5 Billion in Bybit Ethereum Heist

In a recent incident that has shaken the crypto world, hackers believed to be linked to North Korea were responsible for a record-breaking heist at Bybit, a prominent cryptocurrency exchange. The breach, reported on February 21, involved unauthorized access to an Ethereum cold wallet, from which approximately 400,000 ETH—valued at around US$1.5 billion—was illicitly transferred to an unknown address. Despite the gravity of the theft, Bybit’s CEO, Ben Zhou, assured users that the attack was confined to just one wallet, with its other assets remaining secure and withdrawals continuing as normal.

Blockchain researchers and analysts, including firms like Arkham Intelligence and Elliptic, as well as individual expert ZachXBT, linked the theft to the Lazarus Group—a notorious hacking team allegedly commanded by North Korea’s Reconnaissance General Bureau. This group has previously been implicated in several high-profile cyber attacks, including the infamous WannaCry ransomware campaign, the breach of international banking systems, and the 2014 cyber onslaught directed at Sony Pictures Entertainment.

Bybit has taken steps to address the situation by initiating investigations with its security team and forensic experts. The company emphasized that the incident does not compromise the overall safety of client funds, revealing that all assets are fully backed and that its financial stability remains intact. Moreover, a refund program has been launched to compensate users affected by the breach, and Zhou reaffirmed the company’s commitment to covering any potential losses through its reserves or support from partner institutions.

The hack not only dwarfs previous crypto thefts, such as the US$620 million hack from the Ronin Network in 2022, but it also underscores ongoing vulnerabilities in digital asset security amidst rising cyber threats linked to geopolitical actors. Bybit, known for catering to over 60 million users and offering a diverse range of cryptocurrencies, continues to operate normally and is actively reassuring its community of the safety of their investments.