North Korea is responsible for Bybit crypto heist — what happened
On February 21, 2025, the crypto world was shaken by the largest theft of crypto assets in history — a breach of Bybit exchange. This attack resulted in the loss of nearly $1.5 billion worth of ETH tokens.
According to the latest update from the FBI, North Korea is responsible for the theft of cryptocurrency from the exchange. Bureau specifies that the attack was carried out by a notorious group known as TraderTraitor. Authorities have already identified wallets directly linked to this theft, and analysts are thoroughly examining how the perpetrators managed to execute it.
Let's delve deeper into what happened in our overview.
Details of the Bybit attack
First and foremost, this is the largest hacker attack on the crypto industry in history. Bybit has already replenished its reserves and assured users of its security, but the damage remains, and process of tracking further actions is still ongoing.
A key feature of this attack is the speed at which the funds were dispersed and laundered through other wallets. Within the first 48 hours, at least $160 million had already been transferred through the criminal network. Historically, North Korea has been implicated in crypto attacks and use of mixers before, but current scale is significantly larger and was processed much faster. The procedure involved mass conversions between different cryptocurrencies, use of numerous intermediary wallets, and various attempts to obscure the trail through anomalous activity.
Such speed in laundering the money indicates an expansion of the network within North Korea itself or the use of Chinese intermediaries. The AML industry needs to consider serious modernization, as the current tracking capabilities available to specialists do not match the scale and speed of these processes and cannot keep up with such rapid transactions.
Initially, part the stolen Ethereum was redirected to Binance Smart Chain and Solana networks, and subsequently, a significant portion was converted into Bitcoin. Despite the rapid movement of assets, majority of the accumulated Bitcoin remains unmoved, indicating that hackers are preparing for a large-scale liquidation of these assets.
Such actions actually suggest a change in North Korea's tactics; they now rely on a strategy of large-scale transactions. In previous cases, North Korean hackers used platforms like Ren Bridge and Avalanche Bridge, often converting funds into Bitcoin before using mixers like Sinbad, YoMix, Wasabi Wallet, and CryptoMixer. However, due to the tightening of controls over mixers and mandatory measures regarding such platforms as Tornado Cash, North Korea now focuses on speed and automation rather than traditional anonymity.
All of this introduces even more risks into cryptocurrency operations and raises concerns among authorities, crypto exchanges, and users themselves. Although CEO of Bybit exchange is confident that a significant portion of funds can still be recovered, such incidents never go unnoticed, and hackers who have evaded punishment may attempt another attack.
