North Korea’s Lazarus Group Behind Bybit’s $1.4 Billion Ethereum Hack: Arkham

Blockchain data platform Arkham Intelligence says that the North Korean state-sponsored Lazarus hacking group is responsible for swiping over $1.4 billion worth of Ethereum (ETH) and related tokens from crypto exchange Bybit on Friday.

The connection to Lazarus was made via on-chain data that linked activity to previous attacks tied to Lazarus, a group that has been tied to numerous other industry hacks and exploits. The connection was made by pseudonymous on-chain sleuth ZachXBT, who has helped solve many other crypto hacks in recent years.

“His submission included a detailed analysis of test transactions and connected wallets used ahead of the exploit, as well as multiple forensics graphs and timing analyses,” Arkham posted on X.

Arkham had posted a bounty, offering nearly $30,000 worth of ARKM tokens in exchange for figuring out who was behind the $1.4 billion hack that rocked Bybit early Friday—and proceeded to shake crypto markets thereafter.

ZachXBT has yet to detail his findings, but mentioned he and a colleague managed to identify North Korean operators as responsible for the Bybit hack by discovering on-chain connections between wallets used today and those used last month during an $85 million exploit of Phemex, the Singapore-based crypto exchange.

North Korean state-sponsored crypto hackers, collectively dubbed the Lazarus Group by Western investigators, are some of the most sophisticated on-chain operators in the world. Last year, they managed to nab over $1.3 billion from various projects—61% of all ill-gotten crypto stolen in 2024, according to Chainalysis.

There is no one singular “Lazarus Group.” Instead, as far as evidence suggests, North Korea utilizes several teams of operators, each with different specialties, ranging from phishing attacks to complicated on-chain exploits and using false identities to infiltrate crypto companies.

As of writing, it is unclear how sophisticated today’s hack—the largest in crypto history based on asset prices at the time of incident—really was. Bybit insisted that the exploit utilized a “sophisticated attack” that masked the signing interface of a multi-signature transaction and made a hacker-controlled wallet appear as the intended recipient address. Some crypto users pushed back on that narrative, questioning whether Bybit employees fell for a phishing attack.

Either way, North Korea now appears to have nabbed more crypto in a day than it managed to pilfer during the entirety of last year. And it’s highly unlikely those funds will be making their way back to Bybit any time soon; whereas the U.S. government has had success tracking down the parties responsible for exploits like the 2016 Bitfinex hack and forcing them to return stolen funds, North Korean operators are almost impossible to pressure or compel, given their home country’s pariah status.

Editor’s note: This story was updated after publication with additional details.