Bybit was hit with one of the biggest crypto heists in history
Security experts, including ZachXBT, quickly traced the attack to the infamous Lazarus Group. This is a shadowy hacker collective believed to be backed by North Korea.
Lazarus Group has been wreaking havoc in the cyber world since 2010. Their biggest hits include Axie Infinity ($625M), Atomic Wallet ($100M), and Harmony Bridge ($100M). They don’t just steal money—they play the long game, sitting on stolen funds for years. In 2022, Chainalysis reported that Lazarus still held $55M from old hacks. Victims never see their money again.
One key figure linked to Lazarus is Park Jin Hyok. The U.S. accuses him of creating the WannaCry ransomware, hacking Sony Pictures, and stealing from the Central Bank of Bangladesh. His ties to Lazarus come through the Chosun Expo Joint Venture, a front company used to carry out cyberattacks.
The attack targeted Bybit’s multi-signature ETH cold wallet. Hackers tricked signers using a fake interface, secretly altering transaction details. As a result, Bybit unknowingly approved the hacker’s transaction. The stolen ETH was then moved to 53 different wallets, making it harder to trace.
Bybit confirmed that only this wallet was affected. The company is now taking steps to manage the crisis: First, borrowing ETH to allow withdrawals, and then increasing liquidity for USDT and USDC However, since most of their ETH is gone, they’ll eventually have to buy it back from the market—a costly and risky move.
Lazarus Group is now laundering the stolen funds. Some assets are frozen, and detectives are tracking transactions in real-time. But Lazarus isn’t in a rush. Their strategy is to wait until the heat dies down before cashing out.
Meanwhile, the attack has reignited concerns about CEX security. Experts are calling for stronger multi-signature protections and better transaction verification systems. After all, if a major exchange like Bybit can get caught with its guard down, who’s next?
The information discussed by Altcoin Buzz is not financial advice. This is for educational, entertainment, and informational purposes only. Any information or strategies are thoughts and opinions relevant to the accepted levels of risk tolerance of the writer/reviewers and their risk tolerance may be different than yours. We are not responsible for any losses that you may incur as a result of any investments directly or indirectly related to the information provided. Bitcoin and other cryptocurrencies are high-risk investments so please do your due diligence. Copyright Altcoin Buzz Pte Ltd.
Casper Network is betting big on EVM support, AI payments, and quantum-safe blockchain infrastructure with its new multi-year roadmap.
Microsoft's bet on Space and Time is starting to pay off with the launch of Dreamspace, a no code app builder
Worldcoin's World ID is now live and updated. It's out to prove you are human when on the web instead of dealing with a bot.
Biography of Park Jin Hyok: ⫸ The US accuses him of creating WannaCry ⫸ Involved in the Sony Pictures hack ⫸ Stole funds from the Central Bank of Bangladesh He is also linked to the Lazarus Group through the Chosun Expo Joint Venture.
Today, Bybit was hacked through its ETH multi-signature cold wallet. Security expert @ZachXBT has connected the attack to the Lazarus Group. Bybit's CEO said hackers used a fake interface to secretly change transaction details and trick the signers.
Bybit ETH multisig cold wallet just made a transfer to our warm wallet about 1 hr ago. It appears that this specific transaction was musked, all the signers saw the musked UI which showed the correct address and the URL was from @safe . However the signing message was to change
In 2022, Chainalysis found that Lazarus was still holding $55 million from hacks that happened six years ago. They play the long game, waiting patiently. Victims never get their money back. Not once. Lazarus isn't interested in negotiating or refunding.
