0.0
This is the largest theft ever recorded.
3.1
Not a bank vault, not a gold reserve,
6.16
a single transfer
7.48
that moved one and a half billion dollars
9.8
into the hands of North Korea in about
12.14
one minute.
13.419
No password was stolen, no private key was
16.559
cracked, no credential was phished.
18.899
The people
19.679
who authorized that transfer did exactly what their
22.519
security manual demanded.
24.0
They kept the
24.879
money in offline cold storage.
26.94
They required multiple signatures.
29.219
They held hardware security
30.66
keys.
31.379
They checked the destination address with their own
33.899
eyes, and it matched.
35.539
What they saw on
37.1
their screens was a lie.
40.74
It was executed by changing a single file
43.899
on a website.
45.219
February 24,
46.84
2025.
47.82
Inside the operations center of Bybit, a cryptocurrency
50.979
exchange headquartered in Dubai,
52.979
moving tens of billions of dollars,
54.88
a routine transfer begins.
58.38
Four home 1,347 Ethereum tokens, roughly one
63.1
and a half billion
64.0
dollars, moving from Bybit's multi-signature cold wallet
67.959
held offline for security to a warm wallet
70.939
used for day-to-day liquidity.
73.239
Three of Bybit's authorized signers open the safe
76.599
wallet interface
77.359
on their workstations.
78.879
They review the destination address.
81.219
They review the amount.
82.98
Everything
83.64
matches the operation.
84.859
They check the address.
84.859
They check the address.
84.859
They check the amount.
84.879
Everything matches the operation.
85.18
They sign.
87.599
One minute later, 401,000 Ethereum tokens are
91.799
gone,
92.219
not transferred to the warm wallet, transferred to
95.519
an address controlled by North Korea.
98.98
This is the largest single cryptocurrency theft in
102.56
history, recognized by Guinness World Records
105.4
as the largest heist of any kind on
107.7
record, where Bybit, a bank, exceeding even the
111.219
$1 billion Saddam
112.819
Hussein pulled from Iraq's central bank.
114.859
Bybit, a bank, exceeding even the $1 billion
114.859
Saddam Hussein pulled from Iraq's central bank.
114.879
On the eve of the 2003 war, Bybit's
119.12
own systems were never touched.
121.14
The attack did not target Bybit directly.
124.56
Bybit's infrastructure, servers, employee workstations, signing hardware, internal
130.8
networks
131.439
was never penetrated.
133.039
Every subsequent forensic investigation conducted by independent firms,
137.539
Signia and Verichains confirmed the same finding.
141.02
Bybit was not hacked.
142.879
The company that was hacked,
144.879
was Safe, formerly Gnosis Safe, the most widely
148.24
used multi-signature wallet platform in the
151.219
Ethereum ecosystem.
152.9
Safe maintains the web interface at app.safe
156.36
.global through which
157.78
most institutional Ethereum holders manage multi-party authorization
161.659
of large transactions.
164.56
Safe's engineering team numbers approximately 30 people.
168.06
Among them, a small group of system
170.74
administrators have permissions to modify the live production
173.74
code base and the deployed web
175.699
interface.
176.879
Seventeen days before February 21, on February 4,
181.5
one of those engineers is targeted.
185.12
The vector is consistent with the playbook of
188.24
the North Korean unit internally tracked by the
191.06
Federal Bureau of Investigation as Trader Trader.
194.219
The unit is a subcomponent of the broader
197.18
Lazarus
197.86
group, which analysts place within North Korea's system.
200.74
Reconissance General Bureau, the regime's foreign intelligence service.
204.979
The specific technique is not publicly disclosed by
208.879
Safe or by investigators.
210.879
Most likely,
212.12
a highly targeted social engineering approach, routing through
215.599
a LinkedIn contact, a developer
217.539
forum, or a technical collaboration pretext.
220.56
The administrator downloads what appears to be
223.419
a legitimate technical artifact.
225.379
The artifact contains malware.
227.919
The malware steals AWS
230.319
services.
230.719
The malware steals AWS services.
230.719
The malware steals AWS services.
230.719
The malware steals
230.719
accession tokens, not long-lived credentials, the temporary
234.74
authentication tokens that Safe's
236.759
developers use during their normal workday to access
239.939
Amazon Web Services, where Safe's web
242.68
interface is hosted.
243.979
With those tokens, the attackers gain access to
248.0
Safe's AWS account.
250.5
They do not extract data.
252.5
They do not deploy ransomware.
254.819
They do not attempt lateral movement
257.0
through the infrastructure.
258.519
They modify one data.
260.699
They modify one data.
260.699
They modify one data.
260.72
They modify one data.
262.24
They modify one data.
262.24
They modify one data.
262.259
They modify one data.
262.259
The file served from Safe's Amazon S3 storage
265.54
bucket is the front-end JavaScript that renders
268.899
the transaction approval interface in Bybit's signers' browsers.
272.839
The modified version contains
275.18
what forensic investigators later describe as conditional malicious
279.66
logic.
280.74
For the vast
281.959
majority of Safe users—ordinary holders, other exchanges, decentralized
286.98
finance projects—the
289.48
modified JavaScript is the first to use Bybit's
290.699
signers' browsers.
290.699
The modified version contains
290.699
script behaves identically to the legitimate version the
294.079
interface renders normally transactions
297.24
process as expected nothing looks wrong the malicious
301.759
code executes only when specific
304.079
conditions are met those conditions are engineered precisely
308.24
for bybit the code checks is this
311.8
session authenticated against one of three specific wallet
315.72
addresses is the transaction
317.86
being proposed a transfer from bybit's ethereum cold
321.139
wallet if both conditions are true proceed
326.64
if both conditions are true the malicious javascript
330.62
intercepts the transaction data
332.72
just before it is displayed to the signers
334.959
it substitutes the transaction logic what
338.259
the signers see on their screen destination address
341.259
amount operation type remains visually
344.22
identical to the legitimate intended transfer
347.86
what they are actually signing is a delegata
350.42
call to a contract controlled by north korea
353.88
in ethereum delegate call is a primitive that
356.98
allows one smart contract to execute code in
360.06
the context of another with full access to
362.6
the caller's storage and funds when a signer
365.18
approves
365.519
a transaction that includes a delicate call they
368.18
are not merely transferring funds they are
370.68
granting the called contract full control over the
373.199
calling wallet by approving what they believe is
376.699
a
376.8
routine transfer they will be taken under control
377.839
when a signer approves a transaction owned by
377.839
them
377.839
the three Bybit signers grant a North Korean
380.68
controlled contract total ownership of their
383.439
cold wallet.
384.439
The attacker then drains it.
387.18
401,347 Ethereum tokens, $1.5 billion.
393.66
All three signers had multi-factor authentication enabled
397.56
on their accounts.
398.72
All three had active hardware security keys.
402.0
None of that mattered.
403.54
The deception happened
404.92
at the layer above authentication, at the layer
407.819
where the signer's own eyes interpret what the
410.56
signer is being asked to approve.
413.16
Two minutes after the transaction lands on the
416.36
Ethereum mainnet,
417.48
the malicious JavaScript on SACE's website is deleted.
421.3
The modified file is replaced with the
424.259
legitimate version.
425.459
Any subsequent visitor to app.safe.global receives
429.54
clean code.
430.66
The evidence
431.54
is gone from the live environment.
433.939
But SACE
434.759
infrastructure is not the only place the file
437.379
was served.
438.259
Waybat Machine Archives, the public
440.68
archive of the web maintained by the Internet
443.04
Archive, had captured the malicious version
445.48
during its active deployment window.
447.62
When investigators reconstruct the attack, the
450.639
archived file becomes central forensic evidence.
453.8
The attackers had not anticipated that the public
456.74
web archive was quietly making copies of their
459.48
exploit.
462.139
Bybit's detection systems flagged the
464.759
anomaly within minutes.
466.22
CEO Ben Zhou publicly confirms the theft within
469.68
hours.
470.48
Blockchain analysis
471.56
firms begin tracing the stolen Ethereum in real
474.579
time.
475.279
The laundering operation has already started.
478.579
North Korea's cryptocurrency laundering methodology is mature.
483.18
Within the first 48 hours after the
486.18
theft, blockchain analysts estimate that approximately $160 million
491.1
in Ethereum is
492.839
successfully laundered through decent and reliable means.
494.74
The theft was not a mistake.
494.74
The theft was
495.56
not a mistake.
496.379
But thesefulness is something that is very common
496.379
in the real world.
496.379
Throughmez's
496.379
complex use of internet security and wiretapping and
496.379
the use of closed-source web servers has
497.399
been found to be an optical illusion of
497.519
the real world.
497.519
The assets are converted, fragmented,
500.06
mixed through privacy protocols, and reconstituted across thousands
504.04
of blockchain addresses.
505.92
The preferred conversion target is Bitcoin.
509.399
Bitcoin's transaction model uses unspent transaction
512.679
outputs, a structure that treats every transaction as
515.899
a discrete unit, analogous to physical
518.0
cash.
518.919
Tracing a specific dollar value through Bitcoin requires
522.2
following individual UTXOs across IT services.
524.74
many addresses, an exponentially more complex forensic task
528.379
than tracing an Ethereum account.
530.74
North Korea's laundering unit, designated by the FBI
533.86
as Trader Trader, converts roughly 86%
537.279
of the stolen Ethereum to Bitcoin over the
539.779
following 10 days, bridging it mostly through
542.6
a single decentralized protocol.
544.86
The FBI issues a public service announcement on
548.36
February 26,
549.22
2025, five days after the attack, formally attributing
554.019
the theft to North Korea.
555.58
The bureau releases 51 Ethereum addresses identified as
559.679
part of the laundering infrastructure.
561.58
It calls on exchanges, decentralized finance platforms, and
565.899
blockchain intelligence firms
567.419
to block transactions derived from those addresses.
570.84
The attribution is rapid by the
573.639
standards of nation-state cyber attack investigations.
576.799
It is enabled by pattern
578.62
matching.
580.559
The addresses used to move Bybit's stolen funds
584.019
overlap, at specific points, with addresses
586.98
used in prior cryptocurrency thefts.
589.679
The January 2025 Fimex theft, the 2024 BingX
594.62
theft, the
595.559
2023 Poloniex theft.
598.36
Blockchain intelligence firms Elliptic and TRM Labs, along
602.58
with independent
603.259
investigator ZachXBT, established the overlaps within days.
608.7
The thefts are not only a matter of
609.2
time, but also a matter of years.
609.2
The same operators are running the same laundering
611.96
infrastructure across repeated heists.
614.72
The infrastructure is the signature, context for the
618.48
scale.
619.7
According to multiple blockchain intelligence firms, the Lazarus
623.72
Group and its sub-components
625.32
have stolen, over a multi-year period, an
628.279
estimated $6 billion in cryptocurrency.
631.58
In 2024 alone, North Korean-linked theft accounted
635.58
for roughly $1.3 billion across
638.899
47 separate incidents.
640.86
With this single operation, the figure for 2025
644.179
would pass $2 billion.
646.559
Bybit's $1.5 billion, taken in one operation,
650.96
is nearly five times the largest crypto theft
654.179
of the previous year.
655.48
The $305 million taken from Japan's DMM Bitcoin
659.899
exchange in 2024,
661.879
and more than double the previous all-time
664.84
record.
665.419
The $620 million drained from the
668.539
RONIN network in 2022.
671.24
The funds flow, through laundering networks, into accounts
674.519
controlled by
675.36
the Democratic People's Republic of Korea government.
678.32
Treasury Department designations
680.039
have established repeatedly that these accounts finance North
683.139
Korea's weapons programs,
684.659
including ballistic missile development and its nuclear program.
689.899
Bybit, for its part, survives.
692.639
The company is solvent.
694.62
Within hours of the theft, CEO Ben Zhou
697.5
arranges
698.2
bridge loans and strategic inflows from other institutional
701.44
holders to replenish reserves.
703.48
Customer funds remain protected.
705.62
No user lost deposited assets.
708.44
The exchange launches a recovery
710.74
bounty program, offering up to 10% of
713.679
any funds recovered to those who help trace
716.12
or seize them.
717.559
The vast majority of the stolen Ethereum has
720.639
not been recovered.
721.919
The unresolved elements of this case file are
724.919
structural.
726.179
Bybit did nothing wrong by
728.039
the standards of cryptocurrency custody best practices.
731.039
It used cold storage for its reserves.
733.94
It used multi-signature authorization for transfers.
737.74
It used a reputable third-party
739.879
interface provider.
741.0
It used hardware security keys for its signers.
744.179
Every defensive control
745.519
the industry recommends Bybit implemented.
748.34
The attack bypassed all of them by compromising
752.24
a layer outside Bybit's control.
754.96
SAFE, the interface provider,
756.899
serves thousands of institutional clients.
760.059
Any of those clients could have been the
762.159
target.
762.84
Bybit was selected because the attackers had, through
766.22
their initial reconnaissance,
767.7
identified its cold wallet addresses and transaction patterns
771.7
in advance.
772.679
The conditional JavaScript was engineered around those specific
776.659
data points.
778.92
The underlying architectural weakness is general, not specific.
783.759
Any web interface used for signing
786.6
cryptocurrency transactions is, by definition, a potential point
791.179
of display manipulation.
792.62
If the interface can be subtly modified through
795.84
compromise of its hosting infrastructure,
798.08
its content delivery network, its source code repository,
801.62
or its deployment pipeline,
804.0
a signer cannot, in most implementations, independently verify
808.0
what they are actually
809.159
signing.
810.279
Hardware wallets with independent transaction display are a
814.1
partial mitigation,
815.46
but many hardware wallets with a greater level
816.58
of security are potentially more effective.
816.58
Bybit,
816.58
while its do not decode complex transaction structures
819.86
like Delegacol-T in human-readable form,
823.32
they show a raw hash.
825.2
A user staring at a 64-character hexadecimal
828.779
string
829.1
cannot verify its meaning by inspection.
832.019
The user has to trust the interface.
836.34
North Korea demonstrated, on February 25, 2025, the
842.46
cost of that trust.
843.72
Fragment Zero will track the case file.
846.94
The stolen funds continue to fragment across
850.0
the global blockchain.
851.62
Portions remain static in addresses that have been
854.419
tagged and sanctioned.
855.799
Portions continue to move.
857.759
The FBI's 51 identified addresses have grown to
861.679
several
862.0
hundred across multiple chains.
864.34
The developer at Safe, whose machine was compromised,
868.24
has not been publicly named.
870.08
The specific social engineering vector used to
873.559
read the address is not available.
873.7
The FBI's 51 identified addresses have grown to
873.7
several
873.7
hundred across multiple chains.
874.2
The developer has not been publicly named.
875.94
The developer has
876.799
The Lazarus Group continues to operate.
879.36
In the months following the Bybit theft,
881.74
smaller but still substantial thefts measured in tens
885.059
of millions of dollars
886.34
have been attributed to the same infrastructure.
891.1
The deeper question is not whether cryptocurrency can
894.44
be stolen.
895.299
The deeper question is how much
897.86
financial infrastructure now relies on a small number
900.96
of open-source interface projects.
903.7
maintained by small teams updated through live deployment
907.24
pipelines consumed through web browsers
909.72
that sit between billions of dollars in assets
913.179
and the humans authorizing them.
917.0
In this case, the number of people who
919.84
could have prevented the largest theft in history
922.139
was one.
923.84
And he clicked on something.
