[SYS] Verifying clearance code: F6CF ... [VALID]
[SYS] Decrypting document archive ... [OK]
[SYS] Clearance level 7 — RESTRICTED ACCESS
[SYS] Session logged. Monitoring active. Do not copy or distribute.
[SYS] Rendering document ...
CLASSIFIED — LEVEL 7 CLEARANCE REQUIRED
INCIDENT REPORT F6CF -- BYBIT HEIST
Not a bank vault. Not a gold reserve. A single transfer that moved one and a half billion dollars into the hands of North Korea — in about one minute.
The Lazarus Group continues to operate. In the months following
No password was stolen. No private key was cracked. No credential was phished. The people who authorized that transfer did exactly what their security manual demanded. They kept the money in offline cold storage. They required multiple signatures. They held hardware security keys. They checked the destination address with their own eyes — and it matched.
The deeper question is not whether cryptocurrency can be stolen.
February 21, 2025. Inside the operations center of Bybit — a cryptocurrency exchange headquartered in Dubai, moving tens of billions of dollars in daily trading volume — a routine transfer begins. Four hundred one thousand three hundred forty-seven Ethereum tokens. Roughly one and a half billion dollars. Moving from Bybit's multisignature cold wallet, held offline for security, to a warm wallet used for day-to-day liquidity.
RECOMMENDATION: Maintain active monitoring of the named entities and systems. Refer requests for declassified detail to the Office of Operations. In this case, the number of people who could have prevented the largest theft in history was one.
// WITNESS REPORT SUBMISSION
If you have information related to this document, submit your account below. All submissions are monitored.
AGENT DESIGNATION
INCIDENT REPORT / THEORY