Blockchain intelligence firms, including Elliptic and TRM Labs, identified North Korea’s Lazarus Group as the likely culprit behind the US$1.4 billion Ethereum heist from Bybit on Feb. 23, 2025.

Researcher ZachXBT first detected signs of the hack and traced the stolen funds to wallets linked to previous breaches at Phemex, BingX, and Poloniex, which have ties to North Korea.

Elliptic and TRM Labs confirmed the attribution based on laundering patterns matching past North Korean-linked attacks.

Bybit is conducting its own investigation but has not commented on the potential North Korea connection.

The North Korean Permanent Mission to the UN has not responded to requests for comment.

This heist marks the largest recorded crypto theft and adds to a series of cybercrimes linked to North Korea, which reportedly stole over US$650 million in 2024 alone, according to a UN report.

Recent Bybit developments