The Lazarus Group connected to North Korea is continuing to launder the stolen funds following the $1.4 billion Bybit hack. On March 1, hackers transferred an additional 62,200 ETH (approximately $138 million), bringing the total amount cashed out to 343,000 ETH thus far. Blockchain analysis firms predict that the remaining 156,500 ETH could be entirely laundered within the next three days if the current pace is maintained. While the FBI has officially confirmed the North Korean link to the attack, authorities mention that hackers converted the stolen funds into Bitcoin and other crypto assets.
After what is considered one of history’s largest crypto hacks, the $1.4 billion Bybit hack, the Lazarus Group connected to North Korea continues to launder the stolen funds. Hackers moved 62,200 ETH (about $138 million) on March 1, totaling 343,000 ETH cashed out until now. The latest transaction reduced the Ethereum left from the attack on February 21 to 156,500 ETH.
The blockchain analysis firm EmberCN forecasts that if hackers maintain their current transfer speed, the remaining funds could be entirely laundered within the next three days. This indicates that cybercriminals are continuing their activities without slowing down, despite the Federal Bureau of Investigation (FBI) officially intervening in the case and blacklisting addresses associated with the stolen funds.
FBI Confirms North Korean Connection
In a public announcement on February 26, the FBI officially confirmed that the Bybit attack was a North Korean-linked operation. Authorities highlighted that North Korea has been attempting to launder illegal funds through crypto asset theft for a long time.
US officials label this specific North Korean cyber operation as “TraderTraitor.” According to the FBI, TraderTraitor attackers move swiftly, distributing stolen funds to thousands of addresses across different blockchains to launder them. It was also verified that the hackers converted some Ethereum into Bitcoin and other digital assets.
As the FBI shares addresses linked to hackers, the blockchain analysis firm Elliptic identified over 11,000 wallet addresses associated with the attack. Hackers utilize decentralized exchanges (DEX), cross-chain bridges, and instant swap services to hide the trail of stolen funds. They also leverage mixing techniques commonly used in large-scale cryptocurrency laundering operations.
Magnitude of the Cyberattack and Fate of the Funds
The Bybit hack on February 21, 2025, resulted in the theft of a total of 499,000 ETH. So far, 343,000 ETH, equivalent to 68.7% of these funds, was laundered by transferring to different wallets. The FBI assesses that hackers will attempt to convert the remaining assets into fiat currency.
Authorities are calling for active support from the private sector and the crypto ecosystem. RPC node operators, crypto exchanges, DeFi platforms, blockchain analytics firms, among others, are requested to block transactions associated with the addresses used by hackers.
Chainalysis, a blockchain analysis company, mentions that hackers are using various techniques to conceal their tracks. They convert ETH to Bitcoin, DAI stablecoin, and other assets. Notably, hackers continue to move funds through decentralized exchanges without Know Your Customer (KYC) procedures.
Growing Concerns in the Industry
The Bybit attack highlighted the significant damages cyber security vulnerabilities in the crypto ecosystem can cause once again. The swift laundering of stolen assets by North Korean hacker groups, especially through DeFi services, raises the need for regulation in the decentralized finance ecosystem.
While the FBI and other international law enforcement agencies make intense efforts to halt hackers’ activities, the measures taken by the crypto community will determine the course of this process. However, considering the success achieved by the Lazarus Group so far, the possibility of a significant portion of the stolen funds being converted into fiat currency in the coming days appears quite high.