Hackers laundered more than half of the $1,4 billion stolen from Bybit
Experts say they are distributing tokens across hundreds of wallets to make it difficult to track movements
03.03.2025 - 12:55
454
2 min
0
What’s new? IS firm PeckShield estimates that as of March 1, hackers have laundered 280 600 Ethereum (ETH) coins worth $660 million stolen from centralized crypto exchange (CEX) Bybit. This amount represents about 57% of the funds the exchange lost in the February 21 attack.
What else is known? The malware attack on Bybit is currently considered the largest single theft in history. At the time it occurred, the value of cryptocurrencies stolen from Bybit was $1,46 billion.
According to the FBI, as well as cryptocurrency security experts such as Elliptic and an anonymous researcher under the nickname ZachXBT, North Korean hackers from the Lazarus group are behind it, directing the stolen funds to finance the government’s weapons program.
This conclusion was based on the cryptocurrency laundering tactics that the hackers began to implement after the hack. It was typical of Lazarus and involved several steps, including converting tokens into bitcoins and ETH to avoid being frozen, distributing them to hundreds of wallets, and sending them to cross-chain protocols, crypto mixers, and decentralized exchanges (DEX) to make it difficult to track their movements.
PeckShield noted that in just February, the crypto industry lost $1,5 billion in hacks, the worst result in its history. While the hackers have laundered more than half of the assets stolen from Bybit, they still hold 218 750 ETH worth $514,3 million in the wallet.
Late last month, FBI agents urged crypto companies to block transactions by Bybit hackers.
Useful material?
Incidents
Developers warned of potential risks to bridges across the ecosystem and asked exchanges for assistance.
Jun 22, 2026
Incidents
The defendant helped move funds stolen through investment scams and earned at least $4 million for his role in the operation.
Jun 10, 2026
Incidents
The company is linking the incident to a compromised private key on a service wallet, rather than a smart contract exploit
May 22, 2026
Incidents
Following the incident, the project temporarily halted trading operations and node activity.
May 15, 2026
Incidents
The user spent weeks unsuccessfully trying to guess the password until Claude helped find an old wallet backup file
May 14, 2026
Crypto regulations
Authorities are introducing mandatory registration for companies handling cross-border crypto transactions
May 8, 2026

Telegram
Twitter