On February 21, 2025, Bybit - the world's second-largest cryptocurrency exchange by trading volume - lost $1.5 billion in Ethereum to a theft that took approximately ten minutes to execute. The loss exceeded the GDP of several small nations and was the single largest cryptocurrency theft in history, surpassing the previous record (the $625 million Ronin Bridge hack, also attributed to the same threat actor) by more than double. The method was not an exploit of a smart contract vulnerability or a brute-force attack on private keys. It was a compromise of the multi-signature wallet management software used by Bybit's team to approve transactions.
North Korea's Lazarus Group was attributed to the attack within hours by on-chain investigator ZachXBT, and within days by Chainalysis, Elliptic, Mandiant, and the FBI. The attribution was unusually rapid and high-confidence, based on on-chain tracing of fund movements to wallets previously associated with Lazarus operations, characteristic laundering patterns (specific DEX sequences, bridge usage, timing), and infrastructure overlaps with prior campaigns. The attack was a masterclass in supply chain compromise: Lazarus had not attacked Bybit's systems directly but had compromised Safe{Wallet}, the multi-sig infrastructure provider Bybit used, weeks before the theft.
Safe{Wallet} and the Supply Chain Entry Point
Safe{Wallet} (formerly Gnosis Safe) is the most widely used multi-signature wallet infrastructure in the cryptocurrency ecosystem. Multi-signature wallets require multiple private key holders to sign a transaction before it executes - a security model designed so that a single compromised key cannot result in fund loss. Safe{Wallet} provides the smart contract framework and the user interface that organizations use to manage these multi-sig approvals.
Bybit used Safe{Wallet} for its cold storage management. When the security team needed to move funds from cold storage, they would initiate a transaction through the Safe{Wallet} interface, and multiple authorized signers would approve it using hardware wallets (Ledger devices) that required physical button presses to sign. This was considered a highly secure setup: the smart contracts were audited, the signers had hardware wallets that protected private keys from software compromise, and multiple approvals were required.
Lazarus's attack targeted the supply chain upstream: not Bybit's systems, but Safe{Wallet}'s JavaScript code. Forensic analysis by Mandiant determined that attackers had compromised a Safe{Wallet} developer's machine approximately three weeks before the Bybit theft. They used this access to introduce a malicious modification to the Safe{Wallet} app.js file hosted on Safe{Wallet}'s AWS S3 infrastructure. The modification was targeted: it was designed to activate only when the wallet address matched Bybit's cold storage address, and to modify the transaction data displayed to signers versus the transaction data actually submitted to the Ethereum blockchain.
The Execution
At approximately 14:13 UTC on February 21, Bybit's security team initiated what they believed was a routine transfer from their Ethereum cold wallet to the exchange's warm wallet for operational liquidity. Three authorized signers, each using a Ledger hardware wallet, approved the transaction through the Safe{Wallet} interface. Each saw what appeared to be a normal ETH transfer to Bybit's warm wallet address.
What actually executed was a transaction that called upgradeTo() on the multisig proxy contract, replacing the safe wallet implementation with a malicious contract controlled by Lazarus Group. The malicious contract had no spending limits and no multi-sig requirement - it was a replacement that gave Lazarus complete control over all funds held in the contract. Within seconds of the implementation replacement being confirmed on-chain, a separate transaction swept 401,347 ETH (approximately $1.5 billion at the time) to Lazarus-controlled addresses.
Bybit CEO Ben Zhou posted about the incident on X (formerly Twitter) within hours, providing unusually transparent real-time disclosure. He confirmed the theft, stated that the exchange was solvent and that all client funds were covered, and appealed to the blockchain community for help tracing the funds. The exchange secured bridge loans from cryptocurrency companies including Bitget within 24 hours, demonstrating that it could honor all withdrawals.
Laundering at Scale
Moving $1.5 billion in stolen cryptocurrency without converting it to fiat requires a significant laundering operation. On-chain analysts tracked the funds through a characteristic Lazarus laundering pattern that has become identifiable across multiple major thefts.
The stolen ETH was initially distributed across multiple wallets to complicate tracing. It was then converted to Bitcoin through decentralized exchanges (primarily Thorchain, which allows native cross-chain swaps without KYC requirements) and through Ethereum mixing services. The converted Bitcoin moved through a series of intermediary wallets before being deposited to peer-to-peer exchanges and OTC desks that facilitate cash-out without traditional KYC verification.
Chainalysis tracked the funds through multiple hops and estimated that within two weeks, approximately 20% of the stolen funds had been successfully laundered into forms difficult or impossible to freeze. Thorchain's operators debated whether to freeze Lazarus-associated addresses - a technically possible but controversial action for a protocol designed around censorship resistance. Several validators refused to process transactions from identified Lazarus wallets, slowing but not stopping the laundering.
Attribution: Lazarus Group's Signature
The attribution to Lazarus Group was established through multiple independent lines of evidence. ZachXBT, the pseudonymous on-chain investigator who has established a track record of accurate Lazarus attribution, identified fund flows from the theft to wallets previously linked to the 2024 Radiant Capital hack and the 2023 Atomic Wallet hack - both attributed to Lazarus. The timing and volume patterns of fund movements matched historical Lazarus laundering behavior.
The infrastructure overlap extended to the supply chain entry point: analysis of the compromised Safe{Wallet} developer's machine found malware matching variants previously used in Lazarus Group campaigns targeting cryptocurrency companies. The developer had been social-engineered through a fake job interview process - a Lazarus technique documented across multiple campaigns where North Korean operators pose as recruiters and send malicious "technical assessment" files to targets in the cryptocurrency industry.
The FBI formally attributed the attack to Lazarus Group on February 26, 2025, five days after the theft. It was the fastest formal US government attribution of a major cryptocurrency theft.
Context: North Korea's Cryptocurrency Program
The Bybit theft brought North Korea's cumulative cryptocurrency theft to an estimated $6-10 billion since 2017, depending on the methodology used for historical valuations. The program is not incidental to North Korean operations - it is a primary revenue source for the regime. UN Panel of Experts reports have documented that cryptocurrency theft funds North Korea's weapons of mass destruction programs, estimated to account for approximately 40% of the country's foreign currency revenue in years with major thefts.
The scale and sophistication of Lazarus Group's cryptocurrency operations reflects a systematic investment: teams that study target exchange infrastructure for months before attacking, developer-level understanding of DeFi protocols and multi-sig implementations, laundering infrastructure developed over years, and the operational patience to hold stolen assets and wait for optimal conversion windows. The Bybit operation, from the initial Safe{Wallet} developer compromise to the final execution, involved at least three weeks of preparation and likely months of prior reconnaissance.
The practical response options are limited. North Korea is outside the reach of most financial sanctions enforcement; its operators are not extraditable; and the cryptocurrency infrastructure used for laundering is architecturally designed to resist freezing. The most effective interventions have been at the exchange and bridge level - voluntary freezes by centralized services, and validator-level decisions by decentralized protocols - but these require coordination across a fragmented industry with economic incentives against disruption.