Arkham says ZachXBT submitted proof that North Korea's Lazarus Group is behind Bybit's $1.5B hack, which is the largest single theft in crypto history
There are reports that this address was used in an exploit on Bybit. Faarea Masud / BBC : Cryptocurrency theft of £1.1bn could be biggest ever Cas Abbé / Blockchain.News : Lazarus Group Hacks Bybit for $1.46 Billion in ETH Troy Watson / ZyCrypto : North Korean Lazarus Group Likely Behind $1.46 Billion Bybit Exchange Hack Jai Hamid / Cryptopolitan : Lazarus starts laundering the 400,000 Ether it stole from Bybit Bibhu Pattnaik / Benzinga : North Korea's Lazarus Group Suspected in $1.4 Billion Bybit Crypto Hack Vignesh Karunanidhi / crypto.news : Lazarus Group identified in $1.5b Bybit hack: Arkham Qadir AK / Coinpedia Fintech News : Bybit News: $1.4B Stolen in Largest Crypto Hack - Lazarus Group Suspected Markus Thielen / 10x Market Updates : Bybit $1.5 Billion Lazarus Hack - Latest Updates Lennox Gitonga / The Coin Republic : Bybit Receives Support Amid Hack, ZachXBT Exposes Lazarus Group Liam Turner / CryptoNinjas : ZachXBT Identifies Lazarus Group as Bybit $1.4B Hackers, Wins Arkham Bounty Andrew Throuvalas / CryptoPotato : ByBit Lost 70% Of Ethereum Holdings To Hacker, Says CEO Christopher Tepedino / Cointelegraph : ZachXBT identifies Lazarus Group as behind Bybit $1.4B hack, wins Arkham bounty Rohail Saleem / Wccftech : North Korea's Lazarus Group Blames: ByBit Crypto Exchange Suffers A “Sophisticated Attack” … Andrew Hayward / Decrypt : North Korea's Lazarus Group Behind Bybit's $1.4 Billion Ethereum Hack: Arkham Ronaldo Marquez / NewsBTC : North Korean Lazarus Group Identified As Culprit In Bybit's Historic $1.5 Billion Hack Jai Hamid / Cryptopolitan : North Korea's Lazarus Group exposed as the group behind Bybit hack Australian Financial Review : Crypto exchange Bybit says a hacker took control of one of its cold Ethereum wallets, resulting in what analysts estimate was the loss of ~$1.5B worth of tokens Jaxon Gaines / Watcher Guru : North Korea's Lazarus Group May Be Behind Bybit's $1.4B Hack Oliver Knight / CoinDesk : Bybit Loses $1.5B in Hack but Can Cover Loss, CEO Confirms X: @arkham : BREAKING: BYBIT $1 BILLION HACK BOUNTY SOLVED BY ZACHXBT At 19:09 UTC today, @zachxbt submitted definitive proof that this attack on Bybit was performed by the LAZARUS GROUP. His submission included a detailed analysis of test transactions and connected wallets used ahead of [image] @zachxbt : @arkham TLDR myself and Josh from CF connected the Bybit hack on-chain to the Phemex hack @zachxbt : @pikachu_crypto @arkham Partial recovery is more common (15-30% in a good scenario?) but it'll also be a bit harder to launder $1.46B I think depending on how patient they are. For recent hacks Lazarus has mainly just been spamming funds to Chinese exchanges on different chains where it eventually @zerohedge : The Korean have a decade to sell. Bybit has days to replenish Eric Wall / @ercwl : If you want to understand what happens to funds after they're stolen by North Korea/Lazarus Group, the Chainalysis 2022 report is great Step 1: Swap any ERC20s (like stETH) into ETH Step 2: Swap any ETH into BTC Step 3: Cash out BTC to cash (Chinese Renminbi) using Asian [image] @zachxbt : @TheDeFISaint ... Nah doesn't help as much to know who it is when it's a nation state threat actor Saint / @thedefisaint : @zachxbt ... If this is successful, ZachXBT deserves more than this tbh. 50k Arkham is poor for such an incident like this. Forums: r/CryptoCurrency : North Korea's Lazarus Group responsible for Bybit hack resulting in losses of over $1.5 billion: Arkham
Context & Ripple Effects
Bybit first disclosed that an attacker had taken control of a cold Ethereum wallet, creating the immediate operational crisis behind the loss. The subsequent cold-wallet compromise disclosure established the attack mechanism before Arkham reported an attribution based on ZachXBT's on-chain analysis and test transactions.
The alleged attribution fits a documented Lazarus pattern: the group had previously shifted its crypto targeting toward centralized services, while exchanges have also frozen assets linked to its earlier thefts. That makes attribution consequential for tracing and containment, not merely reputational.
First-order effects
- Bybit, Arkham, and other investigators gain a specific alleged perpetrator to prioritize in tracing the stolen assets, rather than treating the incident as an unattributed exchange breach.
- The claim raises the incident from an exchange-security failure to a suspected state-linked theft, increasing scrutiny of Bybit's custody controls and its communications with customers and counterparties.
Second-order effects
- Other exchanges and blockchain-analysis firms are likely to intensify monitoring of wallets and laundering routes associated with the alleged actor; prior freezes of Lazarus-linked funds show how attribution can enable coordinated containment.
- Centralized exchanges face added pressure to demonstrate that cold-wallet protections and transaction-approval processes can withstand sophisticated social-engineering or infrastructure attacks, potentially increasing security and compliance costs.
Third-order effects
- If major exchange losses continue to be tied to state-backed groups, crypto custody security will become a more central competitive and regulatory issue, widening the shift in Lazarus targeting toward centralized services.
- The episode reinforces a structural tension in crypto: public ledgers can aid post-incident tracing, but that visibility does not prevent a large custodial compromise or guarantee asset recovery.
The trend: Large, attributed attacks on centralized crypto platforms are pushing custody security, blockchain surveillance, and cross-exchange coordination toward the center of the sector's legitimacy challenge.