FBI Accuses North Korea-linked Hackers of Stealing $1.5B in Cryptocurrency From Bybit Exchange

ROME (AP) — The FBI has accused North Korean-linked hackers of conducting one of the largest thefts of cryptocurrency publicly known, seizing some $1.5 billion worth of ethereum

The FBI has accused North Korea-linked hackers of one of the largest thefts of cryptocurrency publicly known, seizing some $1.5 billion worth of ethereum from a Dubai-based firm.

The theft earlier this month targeted Bybit, one of the world’s largest crypto exchanges, and comes as part of a broader hacking spree that has seen billions of dollars stolen in recent years.

The hackers are known by the names TraderTraitor and the Lazarus Group and steal cryptocurrency “through the dissemination of cryptocurrency trading applications that were modified to include malware that facilitates theft of cryptocurrency,” according to the FBI.

The agency said it believed the North Korean-backed hackers were “responsible for the theft” of the ethereum from Bybit.

“TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets to Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains,” the FBI said in its announcement late Wednesday. “It is expected these assets will be further laundered and eventually converted to fiat currency.”

North Korea's mission to the UN in Geneva did not immediately respond to a request for comment from AP.

However, North Korea has stolen an estimated $1.2 billion in cryptocurrency and other virtual assets in the past five years, according to South Korea's spy agency. It represents a rare source of badly needed foreign currency to support its fragile economy and fund its nuclear program in the face of intense U.N. sanctions and North Korea's strict border closures during the coronavirus pandemic.

A U.N. experts panel separately said it was investigating 58 suspected cyberattacks by North Korea between 2017 to 2023 that saw some $3 billion stolen to “reportedly help to fund the country's development of weapons of mass destruction.”

Bybit co-founder and CEO, Ben Zhou, acknowledged the FBI’s announcement in a post on the social platform X by linking to a website offering $140 million in bounties for tracking the stolen crypto and getting it frozen by other exchanges.

Bybit has said an attacker manipulated a routine transfer of ethereum, one of the most popular cryptocurrencies, from a so-called “cold” or offline wallet.

“It was a highly sophisticated hack that targeted cold wallets via a blind signing type of exploit, whereby the attackers create a fake interface that deceives users, since it is a near identical copy of the trusted platform,” wrote Manuel Villegas, an analyst at Julius Baer.

The blockchain analytics firm Certik has described the theft as “the largest breach” in the history of blockchain transactions.

The theft has seen overall crypto prices drop in recent days as investors in part have been spooked by the hack despite the industry getting a boost from the election of U.S. President Donald Trump. Industry leader Bitcoin traded over $82,000 a coin on Thursday, down from high of over $100,000 a month ago.

“The situation … is certainly painful for ByBit's customers and will likely raise additional regulatory scrutiny,” Villegas added.