Bybit loses $1.5 billion in crypto theft attributed to North Korea

In February 2025, approximately $1.5 billion in crypto assets were stolen from the exchange Bybit. The FBI has attributed the attack to North Korea, highlighting the geopolitical dimension of cryptocurrency cybercrime.

The heist did not involve breaking the blockchain itself. Instead, attackers exploited vulnerabilities in the authorization process. Despite Bybit using advanced custody mechanisms like cold wallets and multi-signature systems, the criminals compromised the signature interface. This allowed them to make fraudulent transactions appear legitimate to those responsible for authorization, directing assets to addresses under their control.

Following the theft, the attackers attempted to launder the funds by distributing them across thousands of addresses and converting them into other currencies. According to Chainalysis, more than $3.4 billion has been stolen in 2025, making the Bybit incident the largest individual theft recorded in the sector. The event has intensified discussions regarding custody regulations and the need for rigorous governance and monitoring standards for companies holding client assets.