ByBit Breach Uncovered: How Hackers Stole and Laundered Hundreds of Millions

5 mins well spent

North Korean hackers have once again made headlines by pulling off one of the biggest cryptocurrency heists in history. A notorious cybercriminal group known as Lazarus Group managed to steal a staggering $1.5 billion worth of digital assets from crypto exchange ByBit. Now, reports confirm that at least $300 million of those stolen funds have been successfully laundered into usable cash.

The world is watching closely as cybersecurity experts and financial regulators try to track down the rest of the stolen money. But given North Korea’s expertise in cyber warfare and money laundering, recovering these funds is proving to be a nearly impossible task.

Let’s dive deeper into how this heist happened, why North Korea is so good at crypto crime, and whether there’s any hope of stopping them.

How North Korean Hackers Pulled Off the ByBit Heist

The attack on ByBit was highly sophisticated and required expert-level knowledge of the crypto exchange’s internal systems. On February 21, the hackers found a way to manipulate one of ByBit’s suppliers, secretly altering the digital wallet address that was meant to receive a massive transaction of 401,000 Ethereum (a popular cryptocurrency).

ByBit unknowingly sent the funds straight into the hackers’ hands, believing it was transferring them to its own secure wallet. By the time the mistake was realized, the criminals had already begun their elaborate laundering process.

The Immediate Response

Once ByBit discovered the breach, it quickly assured customers that their personal funds were safe and that the exchange had covered the losses using emergency funds. However, recovering the stolen money has been a far greater challenge.

To fight back, ByBit launched a bounty program, offering rewards to anyone who could help track the stolen funds and freeze them before they were converted into real-world cash. So far, this effort has resulted in the recovery of about $40 million, with participants earning over $4 million in rewards.

Despite this success, a large portion of the stolen funds has already “gone dark”, meaning it is now almost impossible to trace or recover.

Why North Korea is So Good at Crypto Crime

North Korea’s government has been accused for years of using cybercrime as a way to fund its military and nuclear programs. The Lazarus Group, believed to be working for the North Korean regime, has become the most successful cybercriminal organization in history when it comes to stealing and laundering cryptocurrency.

Lazarus Group’s Secret to Success

Experts believe the Lazarus Group operates like a well-oiled machine, working in shifts nearly 24 hours a day to move stolen funds across different platforms. They use a variety of advanced tactics to erase the digital footprint of the stolen money, making it extremely difficult for law enforcement and financial institutions to track.

Some of their key strategies include:

• Using Automated Laundering Tools – They rely on highly advanced software to break down and shuffle stolen crypto across thousands of wallets.
• Leveraging Weakly Regulated Exchanges – Some crypto platforms, especially those with loose regulations, unknowingly (or sometimes knowingly) allow laundered funds to be cashed out.
• Mixing Services & Privacy Coins – They utilize crypto mixers and privacy-focused coins like Monero, which make transactions untraceable.

Dr. Tom Robinson, co-founder of Elliptic, a company specializing in crypto investigations, has stated that North Korea is by far the best at laundering stolen crypto. He believes they have an entire team of people dedicated solely to money laundering.

Can Stolen Crypto Be Recovered?

While some stolen funds have been recovered through bounty programs and blockchain tracking, the reality is that most of the stolen money will never be seen again.

Challenges in Stopping Crypto Heists

1. Not All Crypto Platforms Cooperate – Some crypto exchanges are accused of turning a blind eye to suspicious transactions. For example, ByBit has publicly criticized a crypto platform called eXch for allegedly allowing over $90 million in stolen funds to be laundered through its system.

2. North Korea Doesn’t Care About Cybercrime’s Reputation – Unlike traditional cybercriminals who might fear legal consequences, North Korea has no fear of repercussions. The country operates in isolation and has been under heavy sanctions for years, so cybercrime is simply a financial survival strategy for them.

3. Hackers Constantly Evolve – The methods used by Lazarus Group are constantly changing and improving, making it harder for authorities to keep up.

North Korea’s History of Crypto Heists

The ByBit hack is just the latest in a long list of cyberattacks linked to North Korea. Over the past few years, the Lazarus Group has successfully stolen hundreds of millions of dollars from cryptocurrency exchanges worldwide.

Here are some of their most notorious attacks:

• 2019 – UpBit Hack → Stole $41 million worth of cryptocurrency.
• 2020 – KuCoin Attack → Stole $275 million, though most of it was eventually recovered.
• 2022 – Ronin Bridge Hack → Stole $600 million, one of the biggest crypto heists ever.
• 2023 – Atomic Wallet Breach → Stole approximately $100 million.

Despite these crimes, North Korea has never admitted to being involved with Lazarus Group. However, cybersecurity experts and intelligence agencies overwhelmingly agree that the country is using hacking as a key financial tool.

Is There Any Hope of Stopping These Attacks?

Stopping state-sponsored cybercrime is an incredibly difficult challenge, but there are a few measures that could help:

1. Stronger Crypto Regulations – Governments and financial institutions need to tighten regulations on crypto exchanges to prevent criminals from easily cashing out stolen funds.
2. Enhanced Blockchain Tracking – Companies like Elliptic and Chainalysis are improving their tools to track stolen crypto in real-time.
3. International Cooperation – Countries need to work together to freeze suspicious funds and take action against rogue exchanges.
4. Better Security Measures for Crypto Companies – Exchanges need to invest more in security protocols to prevent future hacks.

However, as long as North Korea remains isolated and in need of funding, it is unlikely that these attacks will stop anytime soon.

Final Thoughts

The ByBit hack serves as yet another reminder of just how vulnerable the cryptocurrency world can be. With North Korea’s Lazarus Group constantly improving their techniques, it’s becoming harder and harder to track and recover stolen funds.

While bounty programs and blockchain analysis have helped recover small portions of stolen crypto, the reality is that most of these funds will never be retrieved. And with crypto crime becoming a major source of income for North Korea, we can only expect more attacks in the future.