Bybit got ripped apart by hackers today, and now we know exactly who did it. The infamous Lazarus Group, North Korea’s state-backed cybercriminal syndicate, has been exposed as the masterminds behind the $1.5 billion Bybit exploit, which is the largest crypto theft in history.
The confirmation came from ZachXBT, one of the most respected on-chain sleuths in the space, who dropped indisputable evidence linking Lazarus to the attack.
Arkham Intelligence, which had offered a $50,000 ARKM bounty to identify the attackers, quickly confirmed the findings. The analysis reportedly included wallet connections, test transactions, and on-chain forensic data, all pointing directly to Lazarus Group.
ZachXBT, working with Josh from ChainFeeds (CF), connected the dots between the Bybit breach and a previous attack on Phemex, another crypto exchange. Their research showed that the same addresses, laundering patterns, and exploit methodologies were used in both cases. It was clear: Lazarus was behind it all.
BREAKING: BYBIT $1 BILLION HACK BOUNTY SOLVED BY ZACHXBT
At 19:09 UTC today, @zachxbt submitted definitive proof that this attack on Bybit was performed by the LAZARUS GROUP.
His submission included a detailed analysis of test transactions and connected wallets used ahead of… https://t.co/O43qD2CM2U pic.twitter.com/jtQPtXl0C5
— Arkham (@arkham) February 21, 2025
Arkham’s bounty, valued at $32,000, was a drop in the ocean compared to what Bybit just lost. But the speed at which the bounty worked is unbelievable. Within an hour, ZachXBT had solved the case.
The North Korean Lazarus has been systematically draining the crypto industry for years, funding Pyongyang’s ballistic missile program with stolen digital assets. Their track record includes the WazirX breach in 2023, where they pocketed $235 million, and the Radiant Capital hack, which saw them walk away with $50 million in Q4 2024.
Cryptopolitan Academy: Are You Making These Web3 Resume Mistakes? - Find Out Here