State-linked hackers stole $1.5 billion from Bybit, the agency believes, though Pyongyang previously denied similar theft allegations
North Korea is responsible for the theft of around $1.5 billion in virtual assets from the Dubai-based Bybit cryptocurrency exchange, the US Federal Bureau of Investigation claimed on Wednesday. The heist, which was reported last week, is believed to be the largest crypto hack in history.
While the FBI did not attribute the hack to a specific North Korean group, it said the attackers used something called ‘TraderTraitor’, a set of malicious cryptocurrency applications that trick victims into installing malware under the guise of job offers. Once installed, the malware allows hackers to compromise financial systems and steal funds.
The agency claimed that the hackers quickly began converting portions of the stolen assets into Bitcoin and other cryptocurrencies, dispersing them across thousands of addresses on multiple blockchains. The alleged North Korean perpetrators are expected to later launder the funds and convert them into fiat currency to evade detection, the statement read.
Bybit, an exchange serving over 60 million users, said the breach occurred during a routine transfer between digital wallets. According to the exchange, hackers exploited the process of transferring funds from an offline storage system to a hot wallet used for trading, stealing around 401,000 Ethereum tokens (worth $1.5 billion) and funneling them to an unknown address.
Bybit said the hack was a “sophisticated attack that masked the signing interface, displaying the correct address while altering the underlying smart contract logic.”
The company stated that it had received more than 350,000 withdrawal requests, warning that it could lead to delays in processing. It also called on cybersecurity and blockchain forensics experts to help recover the stolen funds, offering a 10% reward on any amount recovered.
Western intelligence agencies have long accused North Korea of using cyberattacks to fund its weapons programs and evade international sanctions. The Lazarus Group, one of the alleged North Korean hacking units, has been linked to previous cryptocurrency heists, including the $620 million Ronin Network hack in 2022.
While North Korea has yet to comment on the FBI’s allegations, it has previously denied accusations that it is involved in crypto theft, suggesting they are aimed at tarnishing the country’s image.
