On February 21, 2025, Bybit - the world's second-largest cryptocurrency exchange by trading volume - lost $1.5 billion in Ethereum to a theft that took approximately ten minutes to execute. The loss exceeded the GDP of several small nations and was the single largest cryptocurrency theft in history, surpassing the previous record (the $625 million Ronin Bridge hack, also attributed to the same threat actor) by more than double. The method was not an exploit of a smart contract vulnerability or a brute-force attack on private keys. It was a compromise of the multi-signature wallet management software used by Bybit's team to approve transactions.

North Korea's Lazarus Group was attributed to the attack within hours by on-chain investigator ZachXBT, and within days by Chainalysis, Elliptic, Mandiant, and the FBI. The attribution was unusually rapid and high-confidence, based on on-chain tracing of fund movements to wallets previously associated with Lazarus operations, characteristic laundering patterns (specific DEX sequences, bridge usage, timing), and infrastructure overlaps with prior campaigns. The attack was a masterclass in supply chain compromise: Lazarus had not attacked Bybit's systems directly but had compromised Safe{Wallet}, the multi-sig infrastructure provider Bybit used, weeks before the theft.

Safe{Wallet} and the Supply Chain Entry Point

Safe{Wallet} (formerly Gnosis Safe) is the most widely used multi-signature wallet infrastructure in the cryptocurrency ecosystem. Multi-signature wallets require multiple private key holders to sign a transaction before it executes - a security model designed so that a single compromised key cannot result in fund loss. Safe{Wallet} provides the smart contract framework and the user interface that organizations use to manage these multi-sig approvals.

Bybit used Safe{Wallet} for its cold storage management. When the security team needed to move funds from cold storage, they would initiate a transaction through the Safe{Wallet} interface, and multiple authorized signers would approve it using hardware wallets (Ledger devices) that required physical button presses to sign. This was considered a highly secure setup: the smart contracts were audited, the signers had hardware wallets that protected private keys from software compromise, and multiple approvals were required.

Lazarus's attack targeted the supply chain upstream: not Bybit's systems, but Safe{Wallet}'s JavaScript code. Forensic analysis by Mandiant determined that attackers had compromised a Safe{Wallet} developer's machine approximately three weeks before the Bybit theft. They used this access to introduce a malicious modification to the Safe{Wallet} app.js file hosted on Safe{Wallet}'s AWS S3 infrastructure. The modification was targeted: it was designed to activate only when the wallet address matched Bybit's cold storage address, and to modify the transaction data displayed to signers versus the transaction data actually submitted to the Ethereum blockchain.

[TECHNICAL NOTE]
The attack is a variant of what security researchers call a "blind signing" attack combined with supply chain compromise. The modified Safe{Wallet} JavaScript intercepted the transaction approval flow and replaced the legitimate transaction (a routine transfer to Bybit's warm wallet) with a transaction that called the upgradeTo() function on the proxy contract, replacing the safe implementation with a malicious contract that allowed Lazarus to drain all funds. The Ledger hardware wallets showed the signers what appeared to be a normal transaction - the modified JavaScript was controlling what the signing interface displayed, not what the hardware wallet was actually asked to sign. The signers physically pressed their Ledger buttons approving what they believed was a routine transfer.

The Execution

At approximately 14:13 UTC on February 21, Bybit's security team initiated what they believed was a routine transfer from their Ethereum cold wallet to the exchange's warm wallet for operational liquidity. Three authorized signers, each using a Ledger hardware wallet, approved the transaction through the Safe{Wallet} interface. Each saw what appeared to be a normal ETH transfer to Bybit's warm wallet address.

What actually executed was a transaction that called upgradeTo() on the multisig proxy contract, replacing the safe wallet implementation with a malicious contract controlled by Lazarus Group. The malicious contract had no spending limits and no multi-sig requirement - it was a replacement that gave Lazarus complete control over all funds held in the contract. Within seconds of the implementation replacement being confirmed on-chain, a separate transaction swept 401,347 ETH (approximately $1.5 billion at the time) to Lazarus-controlled addresses.

Bybit CEO Ben Zhou posted about the incident on X (formerly Twitter) within hours, providing unusually transparent real-time disclosure. He confirmed the theft, stated that the exchange was solvent and that all client funds were covered, and appealed to the blockchain community for help tracing the funds. The exchange secured bridge loans from cryptocurrency companies including Bitget within 24 hours, demonstrating that it could honor all withdrawals.

Laundering at Scale

Moving $1.5 billion in stolen cryptocurrency without converting it to fiat requires a significant laundering operation. On-chain analysts tracked the funds through a characteristic Lazarus laundering pattern that has become identifiable across multiple major thefts.

The stolen ETH was initially distributed across multiple wallets to complicate tracing. It was then converted to Bitcoin through decentralized exchanges (primarily Thorchain, which allows native cross-chain swaps without KYC requirements) and through Ethereum mixing services. The converted Bitcoin moved through a series of intermediary wallets before being deposited to peer-to-peer exchanges and OTC desks that facilitate cash-out without traditional KYC verification.

Chainalysis tracked the funds through multiple hops and estimated that within two weeks, approximately 20% of the stolen funds had been successfully laundered into forms difficult or impossible to freeze. Thorchain's operators debated whether to freeze Lazarus-associated addresses - a technically possible but controversial action for a protocol designed around censorship resistance. Several validators refused to process transactions from identified Lazarus wallets, slowing but not stopping the laundering.

[WARNING]
The Bybit theft exposed the limits of hardware wallet security against supply chain attacks. Hardware wallets protect private keys from software compromise on the signing machine, but they display transaction data provided by the software interface - and that software was compromised. A Ledger device cannot independently verify that the transaction hash it's signing corresponds to what the user intends; it signs what the software tells it to sign. This is the "blind signing" problem: hardware wallets often display truncated or summarized transaction data rather than the full calldata. The attack would not have succeeded if the signers had been using a separate, uncompromised interface to verify transaction calldata independently before signing.

Attribution: Lazarus Group's Signature

The attribution to Lazarus Group was established through multiple independent lines of evidence. ZachXBT, the pseudonymous on-chain investigator who has established a track record of accurate Lazarus attribution, identified fund flows from the theft to wallets previously linked to the 2024 Radiant Capital hack and the 2023 Atomic Wallet hack - both attributed to Lazarus. The timing and volume patterns of fund movements matched historical Lazarus laundering behavior.

The infrastructure overlap extended to the supply chain entry point: analysis of the compromised Safe{Wallet} developer's machine found malware matching variants previously used in Lazarus Group campaigns targeting cryptocurrency companies. The developer had been social-engineered through a fake job interview process - a Lazarus technique documented across multiple campaigns where North Korean operators pose as recruiters and send malicious "technical assessment" files to targets in the cryptocurrency industry.

The FBI formally attributed the attack to Lazarus Group on February 26, 2025, five days after the theft. It was the fastest formal US government attribution of a major cryptocurrency theft.

Context: North Korea's Cryptocurrency Program

The Bybit theft brought North Korea's cumulative cryptocurrency theft to an estimated $6-10 billion since 2017, depending on the methodology used for historical valuations. The program is not incidental to North Korean operations - it is a primary revenue source for the regime. UN Panel of Experts reports have documented that cryptocurrency theft funds North Korea's weapons of mass destruction programs, estimated to account for approximately 40% of the country's foreign currency revenue in years with major thefts.

The scale and sophistication of Lazarus Group's cryptocurrency operations reflects a systematic investment: teams that study target exchange infrastructure for months before attacking, developer-level understanding of DeFi protocols and multi-sig implementations, laundering infrastructure developed over years, and the operational patience to hold stolen assets and wait for optimal conversion windows. The Bybit operation, from the initial Safe{Wallet} developer compromise to the final execution, involved at least three weeks of preparation and likely months of prior reconnaissance.

The practical response options are limited. North Korea is outside the reach of most financial sanctions enforcement; its operators are not extraditable; and the cryptocurrency infrastructure used for laundering is architecturally designed to resist freezing. The most effective interventions have been at the exchange and bridge level - voluntary freezes by centralized services, and validator-level decisions by decentralized protocols - but these require coordination across a fragmented industry with economic incentives against disruption.

[IOC]
Bybit theft indicators and Lazarus laundering signatures: Initial ETH recipient address 0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2. Funds moved via Thorchain BTC-ETH swaps, eXch exchange, and OKX DEX aggregator. Characteristic Lazarus Bitcoin consolidation pattern: large amounts through multiple intermediate addresses before P2P cash-out. Lazarus developer social engineering vector: fake LinkedIn recruiter personas offering cryptocurrency security roles, sending ZIP archives containing malicious "technical assessment" Python scripts. Prior related campaigns: Radiant Capital (October 2024, $50M), WazirX (July 2024, $235M), Atomic Wallet (June 2023, $100M), Horizon Bridge (June 2022, $100M), Ronin Bridge (March 2022, $625M).