North Korea Responsible for $1.5 Billion Bybit Hack

Originally Published April 9, 2025

I. Targeted Entities

Financial Sector, Crypto Space, ByBit, ByBit affiliates, and ByBit customers.

II. Introduction

On February 21, 2025, Bybit, a major cryptocurrency exchange, experienced a security breach that resulted in the loss of $1.5 billion worth of Ethereum. This incident is the largest digital heist in cryptocurrency history. Bybit is currently collaborating with experts to trace the stolen assets. They have launched a recovery bounty program, offering up to 10% of the recovered amount to individuals who help retrieve the stolen crypto.

The Lazarus Group, a well-known hacking collective believed to be based in North Korea, has claimed responsibility for the attack. This group is notorious for orchestrating high-profile cyberattacks, particularly targeting financial institutions. In this instance, the attackers infiltrated a developer's computer associated with the Gnosis Safe wallet, a widely used multi-signature wallet designed for secure management of cryptocurrency assets. Gnosis Safe operates by requiring multiple private key approvals to authorize transactions, providing an added layer of security to prevent unauthorized transfers.

However, the Lazarus Group managed to manipulate the Safe user interface (UI) specifically used for Bybit transactions. By injecting malicious JavaScript into the UI, they created the illusion that Bybit was authorizing a legitimate transaction. This allowed the attackers to bypass security protocols and facilitate the unauthorized transfer of funds, effectively masking their illicit actions as legitimate business operations. This attack highlights the vulnerabilities associated with software development environments and the potential for targeted manipulation of trusted tools like the Gnosis Safe.

III. Additional Background Information

The Lazarus group, also known as APT38, has been active since at least 2009. The Lazarus group was reportedly responsible for the November 2014 attack against Sony Pictures Entertainment as a part of a campaign named Operation Blockbuster by Novetta. The group has been correlated to other campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.

In 2017, the Lazarus group was reportedly responsible for the creation of the malware used in the 2017 WannaCry 2.0 global ransomware attack; the 2016 theft of $81 million from Bangladesh bank; and numerous other attacks or intrusions on the entertainment, financial services, defense, technology, and virtual currency industries, academia, and electric utilities.

The largest cryptocurrency heist attributed to Lazarus prior was in 2024 with the $308 million attack on Japan-based exchange DMM Bitcoin; the compromise of the Japanese cryptocurrency wallet software firm swiftly led to the company's collapse and was largely known as the single largest crypto theft until now.

IV. MITRE ATT&CK

Initial Access via Supply Chain Compromise (T1071.001): Attackers gained access by compromising a developer's machine associated with Safe , the platform used by Bybit for managing multi-signature wallets.

User Interface Manipulation (T1071.001): They injected malicious JavaScript into the Safe interface, altering transaction details to mislead wallet signers into approving unauthorized transactions.

Transaction Manipulation (T1071.001): By modifying the appearance and details of transactions, the attackers ensured that the signers unknowingly authorized the transfer of funds to addresses under their control.

Command and Control (T1071.001): The use of malicious JavaScript indicates a command-and-control mechanism to deliver and execute payloads on compromised systems.

V. Recommendations

Some recommendations we can offer to ensure your cryptocurrency is secure and mitigate the risks of this hack occurring:

• Enhance security around multi-signature wallets
  • Improving key management ensures they are used correctly, with separate keys stored in different secure locations.
  • With regular key rotation, keys are rotated and used for signing, ensuring they are in the hands of trusted individuals.
• Harden social engineering defenses
  • Having users trained and aware of such attacks significantly reduces the chances of these attacks happening.
  • Training around phishing and data handling practices strengthens awareness as a whole.

• Use hardware wallets (cold storage)
  • Hardware wallets allow users to store their private keys offline, making them immune to online attacks.
  • A way to avoid keeping larger amounts on exchanges.

• Use a trustworthy cryptocurrency exchange – backed by MFA
  • A trustworthy exchange can mitigate risks to wallets on the platform if they are backed by multi-factor authentication and requires verification for each transaction.
  • NEVER sharing your backup codes with anyone.

VI. IOCs (Indicators of Compromise)

The following Ethereum addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors: