Crypto Caper: North Korean Hackers Still Laundering Bybit Loot

by

Crypto Caper: North Korean Hackers Still Laundering Bybit Loot 💸

Crypto Caper: North Korean Hackers Still Laundering Bybit Loot

It appears that the scoundrels behind the Bybit exploit are still at it, laundering a whoppin’ $605 million in Ethereum, despite bein’ unmasked by those clever chaps at blockchain security firms.

Those rascals, North Korea’s Lazarus Group, have been behind some of the most high-profile crypto heists, including the $540 million Ronin Network exploit in 2022. And now, they’re at it again, with blockchain security firms, including Elliptic and Arkham Intelligence, havin’ identified ’em as the perpetrators.

Laundering Continues, Old Chap!

It seems that the hackers have pressed ahead with launderin’ their stolen funds, movin’ approximately 270,000 ETH, worth around $605 million. That’s a tidy sum, if I do say so myself.

The #Bybit hacker is launderin’ funds via #THORChain! 💸

So far, the #Bybit hacker has laundered 270K $ETH($605M, 54% of the stolen funds) and still holds 229,395 $ETH($514M).

— Lookonchain (@lookonchain) February 28, 2025

It all began shortly after the attack on February 21, with the group movin’ around $335 million of the stolen assets by February 25. Blockchain analyst EmberCN said at the time that the hackers still controlled 363,900 ETH, valued at approximately $900 million, in their wallet.

Those clever hackers have been known to use decentralized cross-chain protocols like THORChain to obscure transactions and evade trackin’. And it seems they’re at it again, with THORChain seein’ a significant surge in activity, processin’ over $1 billion in transactions within just a few days.

While the crypto industry continues to enhance security measures, these scoundrels continue to exploit vulnerabilities. In Bybit’s case, the attackers gained access by compromisin’ Safe Wallet, a popular multi-signature wallet provider.

According to blockchain security firm Sygnia, the breach stemmed from malicious code embedded in Safe Wallet’s infrastructure. The hackers planted the exploit and waited for an opportunity to infiltrate Bybit’s systems.

In response, Safe Wallet acknowledged Sygnia’s findings on X, assurin’ users that their assets remain secure and unaffected by the exploit.

“The Safe Wallet team has fully rebuilt, reconfigured all infrastructure, and rotated all credentials, ensurin’ the attack vector is fully eliminated.” Safe said, addin’ that Sygnia’s report did not find any vulnerabilities in the Safe smart contracts or source code.

Bybit Launches Bounty to Recover Stolen Funds

Bybit’s CEO, Ben Zhou, has taken the fight directly to the notorious North Korean hackers, launchin’ a bounty program dubbed lazarusbounty.com, to help recover the stolen funds.

He said the program will reward those helpin’ to catch the perpetrators. So far, the initiative has handed out more than $4 million in rewards to those who have helped Bybit in its quest to claw back its stolen Ethereum.

He also revealed plans to expand the program to assist other victims of Lazarus Group’s attacks, vowin’ to persist in the fight against cybercriminals.

Read More

2025-02-28 19:18