On February 21, 2025, one of the largest cryptocurrency exchanges in the world suffered a theft unlike almost anything the financial system had seen before. An attacker gained control of an Ethereum wallet belonging to Bybit and moved virtual assets worth roughly $1.46 billion. There were no armed men, no vault, and no truck waiting outside the building. Instead, the stolen fortune began moving through the blockchain itself, rapidly converted and dispersed across thousands of addresses. Days later, the FBI attributed the operation to North Korean cyber actors and identified it as part of a campaign known as TraderTraitor. What followed was not simply a theft, but a massive digital money trail.
The Money Was Supposed To Be Safe
Bybit is a major cryptocurrency exchange serving tens of millions of users around the world. Like other large exchanges, it keeps substantial digital assets in wallets designed to provide additional protection, including so-called cold wallets that are generally kept offline or otherwise isolated from routine online activity.
The stolen funds came from one of Bybit’s Ethereum cold wallets during what was supposed to be a routine transfer. According to Bybit’s own account, the attack involved a sophisticated phishing operation that compromised part of the infrastructure used to manage a multisignature wallet and manipulated what authorized signers believed they were approving.
That distinction matters. The attackers did not simply break into an ordinary online account and press a button. They found a way to make legitimate people approve a malicious transaction without fully realizing what had changed.
By the time the problem was recognized, hundreds of thousands of units of Ethereum and related assets had already left the wallet.
Shocking news from the crypto world! Hackers have reportedly stolen $1.5 billion in a massive Ethereum heist, marking a potential record-breaking theft. Is your digital investment safe? Watch this video to understand how the hack occurred, the security risks involved, and what this means for the future of crypto trading.
The Largest Crypto Heist Ever Recorded
The initial loss was estimated at approximately $1.46 billion, making the Bybit incident the largest confirmed cryptocurrency theft on record. Blockchain intelligence firm Elliptic went further, calling it potentially the largest known theft of any kind, surpassing the famous $1 billion Iraqi central-bank robbery associated with Saddam Hussein before the 2003 Iraq War.
The number is difficult to visualize. It was more than twice the value involved in the previous record-setting cryptocurrency thefts that had dominated headlines in earlier years. And unlike a traditional bank robbery, where stolen cash might eventually be found in physical bundles, nearly the entire Bybit haul existed as entries on a digital ledger. That created a peculiar situation for investigators. The money was visible. But knowing where it was did not mean knowing who controlled it.
Then The Money Started Moving
The moment the assets left Bybit’s wallet, the blockchain began recording their journey. Investigators could observe transactions publicly, but the people behind the wallets were not directly identified by their names.
The FBI said TraderTraitor actors rapidly converted some of the stolen assets into bitcoin and other virtual currencies, then dispersed them across thousands of addresses on multiple blockchains. The bureau expected the funds to be laundered further before eventually being converted into conventional government-backed currency.
This is one of the most counterintuitive features of cryptocurrency theft. A public blockchain can make a transaction permanently visible while still leaving the real-world identity behind a wallet difficult to establish. Investigators can see movement. They cannot automatically see the person moving it. That distinction turned the Bybit theft into a huge forensic puzzle.
The Blockchain Became A Trail Of Digital Breadcrumbs
Traditional criminal investigations often depend on physical evidence: fingerprints, cameras, vehicles, bank records or witnesses. Crypto investigations can work differently because every transaction leaves a permanent record that researchers can trace.
That does not make stolen cryptocurrency easy to recover. Criminals can move assets between wallets, convert them into different tokens and send them through multiple blockchain networks, creating a rapidly changing trail that can involve thousands of destinations.
Elliptic, one of the companies tracking the stolen funds, described the laundering process as unusually fast and sophisticated. Within days, large amounts of the stolen cryptocurrency had already been converted and dispersed, making the original holdings increasingly difficult to identify as a single pool of assets.
In this case, however, the investigators had an advantage that ordinary bank robbers do not. The trail never completely disappeared. It remained recorded on the blockchain.
Then The FBI Named North Korea
On February 26, the FBI publicly attributed the theft to North Korean cyber actors and gave the activity the name TraderTraitor. The bureau said the operation fit a broader pattern of North Korean cybercrime involving virtual-asset theft and warned companies across the cryptocurrency industry to block transactions connected to identified addresses.
The attribution was significant because North Korea has repeatedly been accused by governments and cybersecurity researchers of using cyber operations to generate foreign currency while operating under extensive international sanctions. Chainalysis reported that hackers linked to North Korea stole more than $1.3 billion in cryptocurrency across 47 incidents in 2024 alone, then a record annual total.
The Lazarus Group, a North Korean-linked hacking organization frequently cited in connection with major cyber thefts, has become synonymous with this type of operation. Researchers have linked the group to previous attacks against banks, cryptocurrency services and other financial targets.
North Korea has denied many allegations of cyber theft, and attribution in cyberspace is never as straightforward as identifying a suspect standing at a crime scene. But in the Bybit case, the FBI’s conclusion was explicit.
Why Would A Sanctioned Country Steal Crypto?
The answer is partly financial.
North Korea faces extensive international sanctions that restrict its access to the global financial system. Cryptocurrency offers an unusual environment in which large amounts of value can move across borders without relying on the traditional banking channels that are easier for governments to monitor and restrict.
UN sanctions monitors have previously said that proceeds from suspected North Korean cyberattacks were believed to have contributed to the country’s weapons programs. The Guardian reported that UN officials had linked suspected cyber thefts between 2017 and 2023 to efforts to improve North Korea’s nuclear capabilities, although the precise destination of particular stolen funds is generally difficult to establish.
That distinction is important.
It would be misleading to say that investigators traced every dollar stolen from Bybit directly into a weapons program. What the broader evidence shows is that cyber theft has become one of the ways North Korea is suspected of generating revenue and acquiring foreign currency despite sanctions.
The Bybit theft demonstrated just how profitable that strategy can potentially become.
Bybit Had To Do More Than Chase The Hackers
The company also faced an immediate problem closer to home: reassuring customers that their own funds were safe.
Bybit’s CEO Ben Zhou said the exchange remained solvent and that customer assets were backed one-to-one, even if the stolen funds could not be recovered. The company also engaged outside forensic firms to investigate how the attack had occurred and worked with blockchain investigators and other crypto companies to track the stolen assets.
The response became unusually collaborative. Blockchain analysts, exchanges, wallet providers and other firms began watching the stolen addresses, attempting to identify transactions and prevent parts of the haul from being easily converted or used. It was a strange kind of financial manhunt. Nobody was chasing a getaway car. They were chasing a sequence of transactions.
The Attack Exposed A Larger Weakness
The Bybit incident also undermined a comforting assumption about crypto security.
Many people think of cold wallets and cryptographic signatures as almost impenetrable barriers. Yet sophisticated attacks often target the human and software systems surrounding those protections rather than trying to defeat the underlying mathematics directly.
Bybit later said its investigation found that credentials associated with a Safe developer had been compromised, allowing attackers to interfere with the wallet infrastructure and deceive authorized signers into approving a malicious transaction. Independent forensic firms hired by Bybit said they found no indication that Bybit’s own infrastructure had been compromised. That is a lesson familiar far beyond cryptocurrency.
The strongest lock in the world does little good if someone can persuade the person holding the key to open it. In the digital economy, the attack surface is not always the vault. Sometimes it is the process surrounding the vault.
The Money Was Stolen. But It Never Truly Disappeared.
The most fascinating part of the Bybit case is the contradiction at its center.
A fortune worth roughly $1.46 billion was stolen almost instantly, yet the theft did not make the money invisible. Instead, investigators were able to watch portions of the haul move from wallet to wallet across public blockchains. The challenge was turning that enormous stream of visible transactions into something investigators could use to identify the people responsible or recover the assets. That is what makes this crime so different from a traditional robbery.
The thieves did not carry the money away. They changed where the ledger said it was. And then they began trying to make that trail harder to follow. For investigators, the blockchain became both the crime scene and the evidence room.
In February 2025, attackers stole roughly $1.46 billion from a Bybit Ethereum wallet in what became the largest confirmed cryptocurrency theft on record. The FBI attributed the operation to North Korean cyber actors known as TraderTraitor, who quickly converted and dispersed portions of the haul across thousands of blockchain addresses. The money did not simply disappear; its movements remained visible, creating a vast digital trail investigators could follow. The case exposed both the sophistication of modern cybercrime and an unexpected weakness in digital finance: even highly protected systems can be compromised through the people and software surrounding them.
P.S. This article draws primarily on Reuters and The Guardian’s reporting, the FBI’s official TraderTraitor alert, Bybit’s incident timeline and Elliptic’s blockchain analysis. Source: https://www.theguardian.com/world/2025/feb/27/north-korea-bybit-crypto-exchange-hack-fbi
