How the world's largest heist happened
In February 2025, the world’s second-largest cryptocurrency exchange, the Dubai-based Bybit, lost $1.5 billion in Ethereum (401,346.769 ETH) to the North Korean state-sponsored hacking collective, Lazarus Group. This unprecedented breach surpassed previous records.
Lazarus Group is a hacker organization consisting of an unknown number of individuals, allegedly operated by the North Korean government. Initially a criminal group, it has now been designated as an advanced persistent threat (APT) due to its intent, threat level, and wide array of attack methods. Unlike conventional criminal organizations, Lazarus employs specialized teams with expertise in social engineering, malware development, and blockchain analysis. Their operations blend technical precision with psychological manipulation, often targeting developers and third-party service providers to infiltrate high-value systems.
The hack targeted the movement of ETH from a cold wallet to a warm wallet—a type of transaction used to transfer funds from secure, offline storage to wallets that clients use for transactions. It is akin to moving funds from a locked vault to a cashier's till.
Stage 1: Initial Compromise via Supply Chain Attack
According to a post by Ben Zhou, CEO of Bybit, Lazarus gained access to Safe{Wallet}’s infrastructure through a social engineering campaign, likely involving fake job interviews or phishing emails tailored to developers.
Stage 2: Installation of Malicious Code
On February 19, Lazarus replaced a Safe{Wallet} JavaScript file with malicious code designed to activate during the next Bybit transaction. When Bybit initiated a routine transfer on February 21, the code modified the transaction’s destination address to a Lazarus-controlled wallet. The interface displayed legitimate details to the three signers, who unknowingly approved the fraudulent transfer using hardware devices.
Stage 3: Covering Tracks
The malware then erased traces of its activity, restoring the original code to avoid detection. This went unnoticed due to failures in multi-factor authentication and hardware wallet safeguards.
Stage 4: Laundering and Evasion
Immediately after the breach, Lazarus began converting the stolen assets into Ether via decentralized exchanges (DEXs) to evade asset freezes. They utilized 50 wallets and employed various techniques to obscure the money trail and avoid wallet freezes.
Follow This, That and (Maybe), the Other:
Comments
Post a Comment