North Korean hackers believed to be behind the largest cryptocurrency hack, stealing close to $1.5 billion

Bybit, a cryptocurrency exchange, disclosed that it had fallen victim to a significant hack resulting in the loss of nearly $1.5 billion worth of tokens, one of the largest incidents recorded in the industry so far. The attack was orchestrated by a hacker who gained control of one of Bybit’s offline Ethereum wallets, siphoning off an estimated $1.46 billion in assets through a series of questionable transactions.

On-chain analyst ZachXBT, sharing insights on Telegram, indicated that around $1.4 billion had been withdrawn from the exchange, with the funds being transferred to various new addresses for liquidation. The breach, labeled the most substantial cryptocurrency theft to date by Elliptic, surpassed the Poly Network hack of $611 million in 2021, earning it the title of the largest incident across all industries, not just in crypto, according to Rob Behnke, Halborn’s co-founder and executive chairman.

In response to the hack, Bybit CEO Ben Zhou took to a livestream on a popular social media platform to address concerns and assure clients that their funds were secure despite the security breach. The exchange has taken strides to secure bridge loans from partners and has managed to secure a significant portion of the funds required to cover the losses. Zhou mentioned that Bybit would pursue legal action against the hackers and strive to retrieve the lost assets.

Despite the breach, Zhou reassured clients that withdrawals were still operational, with over 70% of withdrawal requests processed post-hack. Bybit is refraining from purchasing Ether to replenish the stolen assets, and Zhou stated that the exchange remains committed to resolving the crisis and safeguarding users’ assets.

Established in 2018, Bybit emerged as one of the top cryptocurrency exchanges globally, facilitating over $36 billion in daily average trading volume. Before the breach, Bybit held approximately $16.2 billion in assets, meaning the stolen Ether accounted for nearly 9% of its total reserves, according to CoinMarketCap.

The stolen funds primarily consisted of $1.12 billion worth of Ether, along with Ether derivatives like stETH, as outlined by Nansen. Following the theft, the attacker sought to conceal the assets by transferring them to a series of wallets, with Ether derivatives converted back to Ether and dispersed across multiple wallets in $27 million increments.

Experts have attributed the attack to Lazarus, a North Korean group recognized for cyber theft activities. Shahar Madar, Fireblocks’ vice president of security and trust products, noted that similar hacking incidents linked to North Korea had occurred at WazirX and Radiant Capital, underscoring the sophistication of the attackers.

The aftermath of the hack had repercussions on the cryptocurrency market, with Ether and other digital assets seeing a decline in prices. Despite the hack’s impact, Bybit-affiliated tokens like USDe saw momentary price fluctuations but remained stable, emphasizing the exchange’s commitment to maintaining collateralized reserves and upholding the integrity of its offerings.