The $1.5 billion Bybit hack was pulled off by North Korean agents, FBI and the crypto exchange say
In This Story
One of the largest publicly-known thefts of cryptocurrency was conducted by North Korean hackers, according to the FBI, who stole $1.5 billion worth of Ethereum from a popular crypto exchange.
The funds were stolen from Dubai-based ByBit on Feb. 21 by a group called TraderTraitor, which has been active since at least 2020, according to the Cybersecurity and Infrastructure Agency. The group uses tactics similar to North Korea’s Lazarus Group, which ByBit has said is behind the hack.
“TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets to Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains,” the FBI said in an announcement posted late on Wednesday. “It is expected these assets will be further laundered and eventually converted to fiat currency.”
Elliptic, a blockchain analytics firm that focuses on financial crime and money laundering detection, estimates that 46% of the stolen assets have been moved into about 50 different crypto wallets, each of which holds about 10,000 Ethereum. That comes out to about $626 million.
An investigation commissioned by ByBit and carried out by Sygnia determined that the root cause of the hack originated from malicious code injected in SafeWallet’s Amazon Web Services (AMZN+0.25%) infrastructure. ByBit itself was not compromised, according to the report.
Earlier this week, ByBit CEO Ben Zhou announced that his firm had launched a “bounty site” targeting the Lazarus Group. “We will not stop until Lazarus or bad actors in the industry is eliminated,” he said.
The ByBit hack is far larger than even the other major thefts that have hit the crypto industry. That includes the 2021 hack of Poly Network, when hackers pilfered $610 million, and the 2022 hack of Ronin Network, which saw thieves steal $615 million.
“Bybit has now become the victim of Web3’s largest theft to date,” blockchain analytic firm Certik said in a blog post. “The escalating frequency and sophistication of these attacks highlight major gaps in operational security.”
