Loading story…
Bybit said attackers stole about $1.5 billion in Ethereum after taking control of one of the exchange’s wallets during a routine transfer from a cold wallet to a warm wallet, making the breach one of the largest digital thefts on record. The Dubai-based exchange said customer assets remained fully backed and pledged to reimburse affected users even if the cryptocurrency is not recovered, while the incident triggered more than 350,000 withdrawal requests and briefly pushed Ethereum’s price down by nearly 4%.
Blockchain investigators at TRM Labs said the stolen funds came from one of Bybit’s offline cold wallets and assessed with high confidence that North Korean hackers were responsible, citing substantial overlaps between attacker-controlled addresses and wallets tied to earlier North Korean thefts. TRM tagged the compromised addresses under Bybit Exploiter Feb 2025 and tracked the assets in real time, while Bybit offered a 10% bounty to cybersecurity and crypto-analytics experts who can help trace and recover the stolen funds.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On 2025-02-22, Tether froze 181,000 USDT connected to the Bybit hack, according to CEO Paolo Ardoino. The same report said recovery efforts had already reclaimed about $43 million with help from Mantle, SEAL, and mETH teams.
TRM assessed with high confidence that North Korean hackers were responsible for the Bybit theft. The attribution was based on substantial overlaps between attacker-controlled addresses in this incident and wallets linked to prior North Korean thefts.
TRM identified the compromised blockchain addresses tied to the theft, tagged them as hacked or stolen funds, and created a tracking entity named "Bybit Exploiter Feb 2025." It used this entity to monitor movement of the stolen assets in real time.
Bybit called on cybersecurity and crypto-analytics experts to help trace and recover the stolen assets, offering a reward equal to 10% of any recovered funds. If the full amount were recovered, the bounty could reach about $140 million.
Following the theft, Bybit said all other wallets were unaffected, customer assets remained backed 1:1, and affected users would be reimbursed even if the stolen cryptocurrency was not recovered. The exchange also reported receiving more than 350,000 withdrawal requests after news of the hack.
Bybit disclosed that attackers stole approximately $1.5 billion in Ethereum after gaining control of one of the exchange’s wallets during a routine transfer from an offline cold wallet to a warm wallet. The theft was described as the largest crypto exploit on record or potentially the biggest single digital theft in history.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
theguardian.com
Open sourcecointelegraph.com
Open sourcetrmlabs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Crypto exchange **Bybit** lost about **$1.5 billion** in Ethereum-linked assets after attackers compromised the platform in what has been described as the largest cryptocurrency theft on record. Blockchain investigators at TRM Labs and a subsequent **FBI/IC3** public attribution linked the operation to North Korean threat actors, citing wallet overlaps and tradecraft consistent with earlier DPRK-backed campaigns. Reporting tied the theft to a broader pattern of financially motivated North Korean operations that have previously targeted major crypto platforms and financial institutions. After the theft, the stolen funds were moved at high speed through intermediary wallets, decentralized exchanges, and cross-chain bridges, with a large share ultimately converted into **Bitcoin**. Analysts said the laundering operation showed an evolution in DPRK tactics away from reliance on traditional mixers and toward rapid, high-volume cross-chain obfuscation; later reporting said more than **$1 billion** had been laundered within months. The heist also triggered recovery efforts, including Bybit's **10% bounty** program for frozen or recovered assets, and intensified debate over cryptocurrency oversight and the implications for future U.S. regulation.
Jun 29, 2026
North Korean hackers were responsible for stealing over $2 billion in cryptocurrency in 2025, marking a 51% increase from the previous year and pushing their all-time total to $6.75 billion. The attacks were characterized by fewer but significantly larger breaches, with the compromise of Bybit alone resulting in the theft of approximately $1.5 billion. Attackers increasingly relied on embedding IT workers within crypto services and using sophisticated impersonation tactics to target executives, while also showing a preference for Chinese-language money laundering services and rapid laundering cycles. Chainalysis data revealed that more than $3.4 billion in cryptocurrency was stolen industry-wide in 2025, with the majority of losses concentrated in a handful of high-impact incidents. The top three hacks, all attributed to North Korean actors, accounted for 69% of confirmed breaches. While individual wallet compromises surged in number, the total value stolen from these incidents decreased, suggesting improved security practices in some areas. However, the scale and sophistication of nation-state attacks on centralized services remain a critical threat to the cryptocurrency ecosystem.
Jun 29, 2026
North Korean hackers have stolen over $2 billion in cryptocurrency assets in 2025, marking the largest annual total ever attributed to the regime’s cyber operations. The majority of this record-breaking sum was taken in a single attack on the cryptocurrency exchange Bybit in February, where $1.46 billion was stolen. In addition to this major breach, blockchain analytics firm Elliptic has linked North Korean actors to more than thirty other cryptocurrency heists throughout the year. These attacks have targeted both exchanges and high-net-worth individuals, reflecting a shift in tactics by North Korean threat groups. The hackers have increasingly focused on wealthy crypto holders and employees of companies with significant digital asset holdings, exploiting the fact that individuals often have weaker security defenses than organizations. Social engineering has become a primary method, with attackers impersonating recruiters or investors to gain the trust of their targets. One common technique involves setting up fake video calls, during which the victim is tricked into running malicious command-line code, resulting in malware installation and subsequent theft of funds. The hackers have also been observed building elaborate fake profiles and leveraging compromised social media accounts to approach their targets. Notable additional breaches attributed to North Korean groups in 2025 include attacks on LND.fi, WOO X, Seedify, and the Taiwanese exchange BitoPro, with the latter resulting in an $11 million loss. The total amount stolen by North Korean hackers in 2025 is nearly triple the amount reported in 2024 and far exceeds the previous record of $1.35 billion set in 2022. These cyber-enabled thefts are believed to directly fund North Korea’s nuclear weapons program, according to the United Nations and various government agencies. Experts caution that the actual amount stolen may be even higher, as many incidents go unreported or lack sufficient evidence for definitive attribution. Discrepancies in reporting between blockchain analytics firms, such as Elliptic and Chainalysis, further complicate the assessment of the true scale of losses. The trend of targeting individuals, especially those with professional connections to major crypto firms, has made detection and prevention more challenging for standard cybersecurity tools. The sophistication and persistence of North Korean cyber operations underscore the regime’s growing reliance on cryptocurrency theft as a means of circumventing international sanctions and funding state objectives. The ongoing rise in cryptocurrency prices, particularly Bitcoin reaching all-time highs, has made the sector an even more attractive target for these state-sponsored actors. Security experts recommend heightened vigilance and advanced security measures for both organizations and individuals involved in the cryptocurrency ecosystem. The evolving tactics and increasing scale of North Korean cyber thefts highlight the urgent need for improved threat intelligence sharing and coordinated international response.
Jun 29, 2026