Arkham says ZachXBT submitted proof that North Korea's Lazarus Group is behind Bybit's $1.5B hack, which is the largest single theft in crypto history
RT Watson / The Block :
Context & Ripple Effects
The allegation places the Bybit theft in a documented chain of suspected or confirmed Lazarus-linked crypto attacks: U.S. Treasury previously tied the group to the Ronin theft, while the FBI later attributed the Harmony Horizon theft to Lazarus and APT38. Treasury's Ronin attribution and the later FBI attribution of the Harmony theft make the claimed identification more consequential than a standalone exchange breach.
Related coverage also shows the practical importance of attribution: when funds from the Harmony attack moved, Binance and Huobi froze bitcoin linked to the hackers. Exchange freezes of Lazarus-linked funds illustrate the enforcement path that may now be tested at far larger scale.
First-order effects
- Bybit, Arkham, and other investigators gain a named suspected perpetrator around which to organize tracing, wallet monitoring, and potential recovery efforts; the report is an allegation based on submitted proof, not an official finding in the supplied record.
- Platforms that encounter addresses or assets tied to the investigation face immediate pressure to screen, flag, or freeze them, following the earlier response to Lazarus-linked Harmony proceeds. Earlier freezes tied to Harmony funds show that this is operationally feasible, though not necessarily sufficient for recovery.
Second-order effects
- Other exchanges and liquidity venues are likely to strengthen scrutiny of inbound flows associated with the suspected attack, raising compliance friction for customers whose transfers intersect with tainted-wallet tracing.
- The scale of the theft increases the reputational and risk-management burden on centralized crypto venues: attribution connects a single platform loss to a repeat threat actor rather than an isolated security failure.
Third-order effects
- If repeated Lazarus attributions continue to be followed by coordinated tracing and freezes, crypto-market infrastructure will become more dependent on cross-platform intelligence sharing and rapid intervention after breaches.
- The pattern sharpens the sector's legitimacy challenge: large thefts attributed to a state-linked group make security controls and the ability to contain illicit proceeds central to confidence in exchange-based markets.
The trend: This is one data point in crypto's shift from treating hacks as isolated platform incidents toward coordinated, attribution-led financial containment of repeat threat actors.