Karsten Wenzlaff, Advisor
August 26th, 2025
Karsten Wenzlaff is a Crowdfunding and Fintech Expert from Germany. He is Secretary-General of Digit[...]
North Korea Linked to $1.4B Bybit Hack, Rapid Recovery
Crypto | Feb 24, 2025
Image: Freepik/rawpixel.com
North Korea’s Lazarus Group Behind Monstrous $1.4B Bybit Hack
On February 21, 2025, Dubai-based Bybit, the second largest cryptocurrency exchange globally, suffered a staggering hack of $1.4 billion of Ethereum in one of the largest crypto heists to date. Credit to Bybit for their swift response within 72 hours, Bybit successfully restored its reserves to a 1:1 ratio, ensuring full backing of all customer assets. A fresh independent audit from cybersecurity firm Hacken confirmed the reserves, demonstrating Bybit’s resilience and strong industry partnerships is reassuring investors during this crisis.
See: Canadian Hacker Indicted in $65M DeFi Heist
Blockchain forensics firm Arkham Intelligence traced the exploit back to North Korea’s Lazarus Group, a well known cybercriminal organization tied to numerous crypto heists. Investigators linked this latest attack to Lazarus through a series of wallet addresses connected to prior hacks. High profile blockchain analyst ZachXBT contributed key insights that mapped the movement of stolen funds and identified suspicious test transactions leading up to the breach. According to Chainalysis, the Lazarus Group was responsible for 61% of all stolen crypto in 2024 (over $1.3 billion in digital assets).
What Happened?
Hackers took advantage of a weakness in Bybit’s system during a routine transfer of funds from its offline "cold wallet" to its online "warm wallet" for transactions. They intercepted the process and redirected approx 401,000 Ethereum to an unknown address. Bybit later explained that the attack was highly advanced that used deceptive techniques to manipulate the transactions approval system which made the fraudulent withdrawals seem legitimate. Some experts believe phishing tactics may have been involved.
Bybit’s Response
Ben Zhou, Bybit's CEO quickly reassured users that all funds remain secure and that the exchange has enough reserves to absorb the loss. He stressed that customer assets are backed 1:1 and announced an aggressive $140 million bounty for anyone who can help recover the stolen funds. Arkham Intelligence had already placed a $30,000 reward on identifying the perpetrators, which helped lead to the Lazarus connection.
Bybit was able to replenish its reserves in record time through strategic partnerships with crypto firms like Galaxy Digital, FalconX, and Wintermute, along with support from Bitget, MEXC and DWF Labs.
See: Milei Faces Political Crisis After $LIBRA Crypto Collapse
The exchange completed a fresh audit just yesterday February 23, 2025, led by an independent third-party cybersecurity firm Hacken who confirmed that Bybit successfully restored reserves to a 1:1 ratio within 72 hours of the attack indicating that the exchange has sufficient reserves to fully back all users. The audit covered 40 different asset types and key holdings such as BTC, ETH, SOL, USDT, and USDC.
Ben Zhou, Co-founder and CEO of Bybit:
"Bybit fully backs all customer assets entrusted to our platform, maintaining a dynamic ratio of over 1:1. We are fortunate to have all-weather friends in a cut-throat industry—our peers and even competitors stood with us during challenging times, and our customers deserve the same level of commitment".
What Happens Next?
Bybit is strengthening its security protocols and working with international law enforcement to track the stolen funds. However, recovering stolen digital assets from North Korean hackers is notoriously difficult because, unlike other hacking groups, Lazarus operates under a government that has no incentive to cooperate with global authorities. This reality is the stolen $1.4 billion of Ethereum will likely be laundered and channelled into funding North Korean activities unless it can be recovered.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
 |  |  |
|---|---|---|
 |  |  |
Leave a Reply