Hackers linked to North Korea have successfully laundered at least $300 million from a record-breaking $1.5 billion cryptocurrency heist targeting ByBit, a leading crypto exchange, according to blockchain analysts.
The cybercriminals, known as the Lazarus Group, infiltrated ByBit two weeks ago in what has been described as one of the largest cryptocurrency thefts in history. This group, which has been accused of conducting cyberattacks to fund North Korea’s military and nuclear programs, has been working tirelessly to move the stolen assets beyond the reach of law enforcement agencies.
Investigators and cybersecurity firms are closely monitoring the movement of the stolen funds in an effort to prevent their conversion into fiat currency. However, experts warn that the chances of recovering the full amount are slim.
"Every minute counts for these hackers, who are highly skilled at hiding the money trail," said Dr. Tom Robinson, co-founder of blockchain intelligence firm Elliptic. "They operate with extreme efficiency, likely working in shifts, and use sophisticated automated tools to launder the funds."
Despite efforts to freeze the stolen assets, ByBit has confirmed that nearly 20% of the stolen funds, about $300 million, have already "gone dark," making recovery highly unlikely.
ByBit’s Response: ‘War on Lazarus’
ByBit’s CEO, Ben Zhou, reassured customers that their funds are secure, as the company has replenished the stolen amount with loans from investors. "We are waging war on Lazarus," Zhou declared, unveiling a bounty program designed to encourage individuals and organizations to track and freeze the stolen crypto.
So far, the initiative has paid out $4 million in rewards to 20 individuals who helped identify and block $40 million of the stolen funds. However, authorities remain skeptical about recovering the majority of the loot.
North Korea’s Growing Cyber Threat
The US and its allies have long accused North Korea of orchestrating cyberattacks to bypass international sanctions and finance its weapons programs. The Lazarus Group, believed to operate under North Korea’s intelligence services, has become increasingly proficient at targeting cryptocurrency platforms, which often have weaker security measures.
"North Korea has effectively built a cybercriminal empire to fund its regime," said Dr. Dorit Dor of cybersecurity firm Check Point. "They have no regard for the legal or reputational consequences of their actions."
The Lazarus Group has been behind several major crypto heists in recent years, including:
A $41 million hack on UpBit in 2019
A $275 million attack on KuCoin in 2020 (most funds were recovered)
The $600 million Ronin Bridge hack in 2022
A $100 million theft from Atomic Wallet in 2023
Exchange Complicity
One of the biggest challenges in preventing such cyber heists is the complicity of certain cryptocurrency exchanges. ByBit has accused the crypto exchange eXch of allowing over $90 million of the stolen funds to be laundered through its platform.
Johann Roberts, the elusive owner of eXch, initially resisted blocking the funds, citing an ongoing dispute with ByBit and uncertainty over the crypto’s origins. However, he later claimed that his company is now cooperating with investigators.
Despite mounting evidence linking North Korea to the Lazarus Group, Pyongyang has consistently denied involvement. The US government has placed several North Korean hackers on its Cyber Most Wanted list, but given the secretive nature of the regime, the chances of arrests remain slim.