Key Takeaways:
- Investigators linked 11,084 crypto wallets to the $1.4 billion Bybit hack, allegedly tied to North Korean hackers.
- Bybit implemented a blacklist API and partnered with Elliptic and ZeroShadow to trace stolen funds and prevent laundering.
- The hack was executed through phishing, compromising cold wallet signers and intercepting a transfer, with stolen ETH later swapped into multiple cryptocurrencies.
Investigators have linked the $1.4 billion Bybit hack to over 11,000 cryptocurrency wallets associated with North Korean hackers, including the notorious Lazarus Group.
Blockchain analytics firm Elliptic identified these wallets as part of efforts to track and recover stolen funds.
Join us on war against Lazarus – https://t.co/6DnaH1WTId
— Ben Zhou (@benbybit) February 25, 2025
Industry first bounty site that shows aggregated full transparency on the sanctioned Lazarus money laundering activities. V1 includes:
– Becoming a bounty hunter by connecting your wallet and help tracing the fund, when…
In response, Bybit CEO Ben Zhou declared “war” on the hackers and introduced a blacklist wallet API to prevent further illicit transactions.
The company also announced a bounty for tracking the stolen assets.
Elliptic released a publicly accessible database of hacker-linked wallet addresses to help the crypto community mitigate exposure to sanctioned funds.
🚨 Free Real-time Bybit Exploit Data 🚨
— Elliptic (@elliptic) February 25, 2025
Elliptic has launched a free data feed of illicit addresses linked to the Bybit exploit.
🔍 Why it matters:
✅ Minimize exposure to sanctions
✅ Stop laundering of stolen funds
✅ Strengthen crypto security
Access via CSV or API ⬇️… pic.twitter.com/U9Qa2tc8Zz
Elliptic’s intelligence API quickly flagged 11,084 wallet addresses linked to the exploit, with this number expected to grow.
Bybit also enlisted Web3 security firm ZeroShadow to conduct forensic blockchain analysis and trace the stolen funds.
According to Chainalysis, the hackers executed the attack via a phishing campaign targeting Bybit’s cold wallet signers, intercepting a routine transfer from an Ethereum cold wallet to a hot wallet.
The stolen assets were converted into various cryptocurrencies and moved across networks to obfuscate their origins.
Despite the breach, Bybit maintained stability, kept withdrawals open, and secured liquidity through loans, which it began repaying on Feb. 25.
Investigations and recovery efforts remain ongoing.
About The Author
Adam Morris, the co-founder of Crypto Head and a respected crypto expert, offers insightful commentary and analysis on cryptocurrency, NFTs, and the evolving digital landscape.
His extensive experience and features in top-tier publications like Forbes and CNN underscore his deep understanding of the crypto world and its future potential.
Check Adam out on: