Arkham Intelligence, a blockchain data platform, claims that the Lazarus hacking group, which is supported by the North Korean state, is behind the theft of over $1.4 billion in Ethereum (ETH) and related tokens from the crypto exchange Bybit on Friday.
The link to Lazarus was established through on-chain data that correlated the current activity with previous attacks attributed to the group, known for executing numerous high-profile hacks in the industry. This connection was identified by the pseudonymous investigator ZachXBT, who has previously solved several crypto-related hacks.
Arkham announced a reward of nearly $30,000 in ARKM tokens for information on the perpetrator of the Bybit hack that significantly impacted the crypto market that day.
While ZachXBT has not yet disclosed his complete analysis, he noted that he and a colleague identified North Korean operators as the culprits by tracing links between wallets used in the recent hack and those involved in a prior $85 million theft from the Singapore-based crypto exchange Phemex.
North Korean state-sponsored hackers, grouped under the name Lazarus Group by Western authorities, are regarded as some of the most advanced operators in the crypto space. In the previous year alone, they stole over $1.3 billion from various projects, accounting for 61% of all illicit crypto thefts in 2024, according to Chainalysis.
There is no single entity known as the “Lazarus Group.” Evidence suggests that North Korea employs multiple teams of hackers, each specializing in various methods, including phishing and elaborate on-chain attacks, often using fake identities to infiltrate crypto firms.
At the time of writing, it remains uncertain how advanced the recent hack was—the largest in the history of crypto by asset value during the incident—but Bybit claimed that the attack involved a “sophisticated attack” that disguised the signing interface of a multi-signature transaction, making a hacker-controlled wallet appear to be the legitimate recipient. Some in the crypto community challenged this explanation, proposing that Bybit employees may have fallen victim to a phishing scheme.
Regardless, North Korea appears to have acquired more crypto in a single day than it did throughout the previous year. It is unlikely that these funds will be returned to Bybit; while U.S. authorities have successfully traced and recovered stolen assets from incidents like the 2016 Bitfinex heist, applying pressure on North Korean hackers is nearly impossible due to the country’s isolated status.
