North Korean state hackers stole $1.5 billion from the Bybit exchange.

On 21 February 2025 attackers drained about 401,000 ETH, roughly $1.5 billion, from a Bybit cold wallet, the largest theft of crypto assets on record.

The same day, an on-chain trace submitted to Arkham Intelligence by the investigator ZachXBT, and a separate analysis by Elliptic, linked the receiving wallets and the laundering pattern to North Korea's Lazarus Group.

On 26 February the FBI stated that North Korea was responsible, named the activity 'TraderTraitor', and published the Ethereum addresses that held the stolen assets.

The engine returns Supported. Every source infers attribution from the movement of funds; none of them discloses direct evidence of who operated the attack.

• FBI Public Service Announcement I-022625-PSA (26 February 2025)
  Law enforcement
  Attributes the theft to North Korea ('TraderTraitor'); lists the holding addresses.
• Elliptic (21 February 2025)
  Blockchain analytics
  Attributes the theft to the Lazarus Group from the laundering pattern.
• ZachXBT trace submitted to Arkham Intelligence (21 February 2025)
  Independent investigator
  Links the receiving wallets to wallets previously attributed to Lazarus.