FBI Issues Urgent Warning on $1.5 Billion Bybit Hack, Calls for Action Against North Korean Hackers

FBI Issues Urgent Call to Block Transactions Linked to $1.5 Billion Bybit Hack

The FBI has raised the alarm after confirming that a major cyberattack on cryptocurrency exchange Bybit was orchestrated by North Korean hackers.

The theft, which saw approximately $1.5 billion in digital assets stolen, has prompted a request for action from the global crypto community, urging exchanges, blockchain analytics firms, and other industry players to block any transactions linked to the stolen funds.

Source: FBI

North Korean Hackers Behind Bybit Breach

In a public service announcement, the FBI confirmed what had been speculated in the industry.

The hack was the work of North Korea’s state-sponsored hacking group, known variously as TraderTraitor, Lazarus Group, APT38, BlueNoroff, and Stardust Chollima.

This group has long been a threat to the crypto ecosystem, carrying out high-profile heists and laundering stolen funds to fund North Korea’s missile programmes.

Bybit confirmed that the hack took place on 21 February 2025, when hackers intercepted a scheduled fund transfer from one of the exchange's cold wallets to a hot wallet.

The stolen cryptocurrency was then redirected to a blockchain address controlled by the hackers.

FBI's Warning to Crypto Node Operators

In response to the breach, the FBI is urging crypto node operators, exchanges, bridges, DeFi services, and blockchain analytics companies to block any transactions linked to the stolen funds.

The agency highlighted that the stolen assets are rapidly being laundered and dispersed across multiple addresses on different blockchains, complicating tracking efforts.

The FBI also shared a list of 51 Ethereum addresses connected to the hackers.

Source: FBI

The authorities warned that these assets could eventually be converted into fiat currency, making it even harder to trace the stolen funds.

The FBI further advised the private sector to take immediate action to help prevent further financial crime.

Hackers Launder Stolen Funds through Multiple Channels

Since the theft, the hackers have reportedly laundered over 135,000 Ether (ETH), with the funds being dispersed across a variety of wallets and exchanges.

Blockchain forensics firms such as Chainalysis and Elliptic have tracked the movements, revealing that the stolen Ether has been converted into Bitcoin, stablecoins like Dai, and other assets through decentralised exchanges, cross-chain bridges, and services that lack Know Your Customer (KYC) protocols.

ZachXBT, a well-known crypto fraud investigator, identified that some of the funds were routed through Ethereum addresses previously linked to other high-profile hacks attributed to the Lazarus Group.

These findings were later confirmed by Elliptic and TRM Labs, both of which pointed to substantial overlaps between the addresses involved in the Bybit hack and previous North Korean thefts.

FBI Issues Public Service Announcement

In an effort to prevent further laundering of the stolen assets, the FBI has made a public service announcement.

The Bureau urged industry players to block transactions originating from the addresses tied to the North Korean hackers, saying,

“TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets to Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains.”

The FBI’s warning underscores the seriousness of the situation, highlighting that these funds are likely to continue being laundered and eventually converted into fiat currency, a process that could fuel further criminal activities.

Hackers Use Safe{Wallet} Platform to Access Funds

The hack targeted Bybit’s Safe{Wallet} platform, with the attackers gaining access through a compromised developer machine.

The hack was first investigated by cybersecurity firms Sygnia and Verichains, who revealed that a disguised malicious transaction proposal was made after infiltrating the Safe{Wallet} infrastructure.

This breach is part of a broader pattern of North Korean-backed cyberattacks on the cryptocurrency sector.

According to Chainalysis, North Korean hackers stole over $1.3 billion in crypto during 2024 alone, and Elliptic reported that the Lazarus Group has stolen more than $6 billion in total since 2017.

The stolen funds are widely believed to be funnelled towards North Korea’s ballistic missile development programs.