started · updated
Bybit theft exposes North Korean cryptocurrency laundering networks
A massive cryptocurrency theft from the exchange Bybit in February 2025 has exposed the sophisticated laundering networks used by North Korean hacking groups. The FBI has attributed the attack to North Korean actors known as TraderTraitor. The theft involved approximately $1.46 billion to $1.5 billion in assets.
Investigations by security firms and blockchain analysts reveal that stolen funds are rapidly moved across multiple blockchains using cross-chain swaps and decentralized protocols like THORChain. According to zeroShadow, over $1 billion of the Bybit proceeds was laundered within four months through professional networks, often involving Chinese intermediaries who facilitate the conversion of crypto into fiat currency.
Blockchain investigator ZachXBT reported tracing more than $12 million in funds linked to the theft and identified a broader network believed to have laundered over $1 billion for the North Korean Lazarus Group. While centralized entities like Tether have successfully frozen millions in exploited funds, the use of decentralized systems and professional money launderers continues to pose significant challenges for international law enforcement.
Entities
Bybit · FBI · North Korea · Royal United Services Institute · THORChain · Tether · ZachXBT · zeroShadow
Claims
What the coverage asserts, and how many sources carry each claim.
- [○ 1 SOURCE] ZachXBT identified a network believed to have laundered over $1 billion from North Korean Lazarus Group thefts. cryptoslate.com
- [● 2 SOURCES] Approximately $1.5 billion was stolen from the cryptocurrency exchange Bybit. www.tokenpost.com · cryptoslate.com
- [○ 1 SOURCE] Tether froze $181,000 in USDT linked to the hack on February 22, 2025. www.tokenpost.com
- [○ 1 SOURCE] Blockchain investigator ZachXBT traced more than $12 million in funds linked to the Bybit theft. cryptoslate.com
- [● 2 SOURCES] The FBI attributed the February 21, 2025, theft to North Korean actors known as TraderTraitor. www.tokenpost.com · www.crypto-news-flash.com
- [○ 1 SOURCE] By February 23, 2025, $42.89 million in exploited funds had been frozen. www.tokenpost.com
- [● 2 SOURCES] Approximately $1.46 billion in cryptocurrency was stolen from Bybit. www.crypto-insiders.nl · www.crypto-news-flash.com
- [○ 1 SOURCE] More than $1 billion from the Bybit theft was laundered within four months. www.crypto-insiders.nl