Executive summary
On February 21, 2025, cryptocurrency exchange Bybit suffered a catastrophic security breach in which approximately $1.5 billion was stolen. The attack has been attributed to North Korean state-sponsored hackers, specifically the Lazarus Group. It was larger than all the cryptocurrency thefts by North Korean actors in 2024 combined, and it shows how sophisticated supply chain attacks in the blockchain industry have become. This post-mortem covers:
- How the attack unfolded, through a supply chain compromise of Safe{Wallet}.
- The role of the Lazarus Group, an Advanced Persistent Threat (APT) actor whose tactics keep changing.
- Lessons for CISOs, CTOs and blockchain security teams.
- Proactive security strategies to prevent similar breaches.
Introduction
Bybit lost approximately $1.5 billion on February 21, 2025, in the largest digital heist in history. The breach has been formally attributed to North Korean state-sponsored hackers, specifically the Lazarus Group. It exceeds all North Korean cryptocurrency thefts in 2024 combined, and it exposes critical vulnerabilities in cryptocurrency infrastructure. This post-mortem examines how the attack unfolded through a supply chain compromise, what the Lazarus Group is capable of, and the risks that Advanced Persistent Threat (APT) groups pose to organizations worldwide.
About HYDN Security
HYDN is a team of cybersecurity experts with significant experience in senior roles at major organizations like Cisco, IBM X Force, NYSE, and Alert Logic. That background means we understand the cybersecurity problems large organizations face.
HYDN’s founder, Warren Mercer, has been involved in uncovering some of the biggest cyber attacks in the past decade including the 2018 Olympic Destroyer attack, labelled the “Most Deceptive Hack in History” by WIRED.
Warren has discussed his role in uncovering the perpetrators in many speaking and media engagements including on the BBC Podcast “Lazarus Heist” and in the documentary Tomorrow Unlocked.
HYDN’s Advanced Adversarial Simulation service enables companies to simulate a tailored attack aimed at circumventing traditional network controls. HYDN’s team uses the same tactics, tools, techniques and mindsets as attackers such as Lazarus Group to uncover weaknesses and help you fix vulnerabilities, so that you can protect your data and your customers’ data.
HYDN have worked with a number of huge names in both Web2 and Web3 including Consensys, Metamask, a16z, SushiSwap, Bittrex Global, Sablier, and many more.
The anatomy of the Bybit breach
The U.S. Federal Bureau of Investigation has formally attributed the $1.5 billion theft to North Korean threat actors, specifically a cluster they track as TraderTraitor, which is also known as Jade Sleet, Slow Pisces, and UNC4899. It follows a run of increasingly ambitious cryptocurrency heists by North Korean hackers, who stole approximately $1.34 billion across 47 incidents throughout 2024. The February attack against Bybit alone exceeds that entire annual figure.
Timeline and initial compromise
The attackers laid the groundwork days before the theft. According to forensic analysis by security firm Verichains, they began their operation on February 19, 2025, at 15:29:25 UTC, when they replaced a benign JavaScript file on app.safe.global with malicious code specifically designed to target Bybit’s Ethereum Multisig Cold Wallet. Targeting that precise shows a detailed understanding of Bybit’s infrastructure and transaction processes.
Preparation continued on February 20, 2025, at 22:21:57, when the Lazarus Group registered a suspicious domain, bybit-assessment.com, just hours before the theft. The domain was registered using an email address previously linked to Lazarus Group operations, which ties it to their earlier campaigns. The attack itself was triggered on February 21, 2025, at 14:13:35 UTC, during what appeared to be a routine transfer from Bybit’s Ethereum cold wallet to a hot wallet. The compromised system redirected approximately 401,000 ETH, valued at nearly $1.5 billion, to addresses controlled by the attackers.
The Safe{Wallet} supply chain attack
Investigations by multiple security firms found that the breach did not begin with a direct attack on Bybit’s systems. It began with a supply chain compromise of Safe{Wallet}, the multisignature wallet platform Bybit used to secure its cryptocurrency holdings. Forensic investigations by security firms Sygnia and Verichains identified malicious code originating from Safe{Wallet}’s infrastructure as the root cause. Safe{Wallet} later confirmed that the attack “was achieved through a compromised machine of a Safe{Wallet} developer resulting in the proposal of a disguised malicious transaction.”
Technically, the attack involved phishing the cold wallet signers into signing malicious transactions. Those transactions replaced the Safe’s multi-signature wallet implementation contract with a malicious version controlled by the attackers. Security experts suspect that the AWS S3 or CloudFront account/API Key of Safe.Global was likely leaked or compromised, which created the entry point for the supply chain attack. The Lazarus Group clearly understands cryptocurrency infrastructure well, and it chose to exploit a trusted service provider over a more heavily fortified primary target.
Post-breach money movement and laundering operations
After exfiltrating the funds, the attackers set about obscuring the money trail. According to blockchain analytics firm Chainalysis, which is assisting in the investigation, “TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets to Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains.” The FBI further noted that “it is expected these assets will be further laundered and eventually converted to fiat currency”.
The laundering operation involved swapping significant portions of the stolen ETH for tokens including Bitcoin and DAI. The hackers used decentralized exchanges, cross-chain bridges, and no-KYC instant swap services to move assets across networks. A notable portion of the stolen funds has remained dormant across various addresses. This is a deliberate strategy North Korean hackers often use to outlast the scrutiny that follows a high-profile breach.
The Lazarus Group: North Korea’s elite cyber warfare unit
The attack on Bybit has the hallmarks of the Lazarus Group, one of the most effective state-sponsored hacking groups in the world. It operates under the control of North Korea’s Reconnaissance General Bureau. The group began with politically motivated attacks and now runs financial heists that are a crucial revenue stream for the heavily sanctioned North Korean regime.
Evolution of capabilities and cryptocurrency focus
In recent years the Lazarus Group has shifted from politically motivated attacks to financially driven operations, with a particular emphasis on cryptocurrency platforms. The shift reflects North Korea’s decision to use cyber operations to evade international sanctions and generate foreign currency. North Korea-linked actors are estimated to have stolen over $6 billion in crypto assets since 2017.
The group has grown steadily more capable, as its success rate and the size of its thefts show. According to Chainalysis data, in 2024 alone, North Korean hackers stole approximately $1.34 billion across 47 incidents, a 102.88% increase from the $660.5 million stolen in 2023. The Bybit hack, at $1.5 billion, exceeds all of their 2024 cryptocurrency thefts combined.
Technical tactics and social engineering expertise
The Lazarus Group’s tactics, techniques, and procedures (TTPs) combine technical exploits with elaborate social engineering. The group is particularly practised at targeting companies in the Web3 sector, often tricking victims into downloading malware-laced cryptocurrency applications. It has also run job-themed social engineering campaigns that lead to the deployment of malicious npm packages.
The TraderTraitor cluster attributed to the Bybit attack has been implicated in other significant cryptocurrency thefts, including the $308 million heist from cryptocurrency company DMM Bitcoin in May 2024. The recent investigation has also uncovered connections to another Lazarus Group campaign dubbed “Contagious Interview”. Victims are typically approached via LinkedIn and socially engineered into fake job interviews, which serve as an entry point for targeted malware deployment, credential harvesting, and further compromise.
The organizational risk posed by Advanced Persistent Threats
The Bybit attack shows the risk that APT groups like Lazarus pose to organizations, particularly in the financial and cryptocurrency sectors. These groups are persistent and sophisticated, and they have substantial state resources behind them.
Supply chain vulnerabilities and third-party risk
One of the most concerning aspects of the Bybit breach is how effectively it exploited the supply chain. An organization with strong internal security is still vulnerable if its trusted partners and service providers have exploitable weaknesses. Bybit’s security was compromised through a trusted third-party wallet provider, with no direct attack on its own infrastructure.
Supply chain compromise has become increasingly common in APT operations. Attackers target less secure entities that have legitimate access to the primary target, and so bypass its security controls. For cryptocurrency organizations, this means securing internal systems is not enough. They also need thorough due diligence on every vendor and partner with access to critical assets or infrastructure.
The challenge of defending against state-sponsored threats
State-sponsored threat actors like the Lazarus Group are harder to defend against than financially motivated criminal groups. They operate with the resources and backing of a nation-state, which gives them capabilities beyond those of typical cyber criminals. They have virtually unlimited time to plan and execute attacks, substantial financial resources, and in some cases, the ability to develop or purchase zero-day exploits.
These groups can conduct extensive reconnaissance on targets, craft highly convincing social engineering campaigns, and wait patiently for the right moment. Security approaches that rely mainly on technology often fail against them, because even the best technical controls can be circumvented if attackers manipulate authorized users through social engineering. The Bybit incident shows that even specialized cryptocurrency security companies with significant resources can fall victim to these tactics.
Financial and reputational consequences
The direct financial impact of APT attacks can be devastating. The $1.5 billion loss from the Bybit attack is one of the largest thefts of any kind in history. Bybit has committed to covering customer losses, but incidents like this can threaten the solvency of affected organizations and damage confidence in the wider cryptocurrency ecosystem. The reputational damage can also have long-lasting effects on customer trust and company valuation.
In response to the breach, Bybit has launched a bounty program to help recover the stolen funds, offering rewards to those who can assist in retrieving the cryptocurrency. Through industry collaboration, including efforts by Chainalysis and other security firms, more than $40 million in stolen funds have already been frozen. That is less than 3% of the total stolen amount, which shows how hard it is to recover assets once they are gone.
Lessons for CISOs, CTOs and security leaders
1. Strengthen supply chain security
- Conduct regular security audits of third-party service providers.
- Implement code-signing and integrity verification for software updates.
- Require multi-party validation before integrating external software components.
2. Harden multi-signature wallet security
- Implement Multi-Party Computation (MPC) to reduce reliance on single-signature authorization.
- Enforce hardware security modules (HSMs) for transaction approvals.
- Establish time-locks and anomaly detection for high-value transactions.
3. Improve adversarial simulations and threat intelligence
- Run regular red team exercises to simulate APT-level attacks.
- Use threat intelligence feeds to monitor Lazarus Group activity.
- Deploy anomaly detection systems to flag suspicious transaction patterns.
4. Deploy Zero Trust and enhanced authentication
- Enforce Zero Trust Architecture (ZTA) with continuous authentication.
- Require biometric or behavioral authentication for high-risk transactions.
- Implement Just-In-Time (JIT) access controls to limit exposure.
Proactive defense strategies against APT threats
Defending against threats like the Lazarus Group takes a proactive, multi-layered approach. Organizations need to move beyond compliance-focused security, think like an adversary, and assume they will be breached.
Adversarial simulation and red team exercises
One of the most effective ways to test defenses against APT groups is adversarial simulation. In these exercises, often called red team assessments, ethical hackers simulate real-world attacks against an organization’s people, processes, and technology. By mimicking the tactics, techniques, and procedures of groups like Lazarus, organizations can find weaknesses before real attackers exploit them.
Effective adversarial simulations go beyond traditional penetration testing and cover the full attack lifecycle, including social engineering, persistence mechanisms, and data exfiltration techniques. For cryptocurrency organizations, the exercises should specifically simulate the supply chain attacks and social engineering campaigns the Lazarus Group has used successfully in the past.
Understanding threat actor behavior through intelligence
To build effective defenses you need to understand how specific threat actors operate. Threat intelligence on the Lazarus Group’s techniques lets organizations put targeted countermeasures in front of their most likely attack vectors. For cryptocurrency organizations, this means specific defenses against the social engineering tactics Lazarus commonly uses, multi-party computation for transaction approvals, and anomaly detection systems that can identify unusual transaction patterns.
Incidents like the Bybit hack reveal how North Korean threat actors are changing their tactics. Organizations should use that intelligence to keep updating their defenses and their security awareness training.
Technical and procedural controls
The Bybit incident shows the need for both technical and procedural controls against supply chain attacks. The main measures are hardware security modules for critical key storage, out-of-band verification for high-value cryptocurrency transactions, and time-locks and transaction limits that give a human the chance to review large transfers before they are processed.
Organizations should also conduct regular security assessments of all third-party services with access to critical systems, implement a zero-trust architecture that verifies all access attempts (even from trusted partners), and develop incident response playbooks specifically for cryptocurrency theft scenarios. Together, these measures can significantly reduce the risk of a successful attack.
Conclusion
The $1.5 billion Bybit hack was a supply chain attack carried out by North Korea’s Lazarus Group. It shows both the technical capability of state-sponsored threat actors and the catastrophic impact they can have on the organizations they target.
As cryptocurrency adoption grows, the incentives for attacks like this will only increase. Traditional security approaches are insufficient against APT groups with the resources, patience, and expertise of the Lazarus Group. Protecting digital assets requires a proactive security posture that includes adversarial simulation, threat intelligence, and defense in depth.
The industry response to the Bybit hack, including the rapid attribution to North Korean actors and the freezing of some stolen assets, shows what collaborative security efforts can achieve. But defenders must get everything right, while attackers only need to succeed once. The lessons from this incident should inform stronger security practices across the cryptocurrency ecosystem and in other financial sectors that these actors may target.
HYDN’s adversarial simulation services
Each organization has its own security needs and challenges. HYDN’s adversarial simulation services are customized to fit your specific environment and security requirements. We don’t believe in a one-size-fits-all approach, and we tailor each simulation to give you the most value.
Adversarial simulation helps organizations:
- Identify vulnerabilities: simulating an attack lets organizations find and fix vulnerabilities before they are exploited.
- Improve incident response: it tests the organization’s incident response procedures, so teams are prepared to respond quickly and effectively to an attack.
- Improve security team skills: regular simulation keeps your security team sharp and prepared for real attacks.
- Support compliance and risk management: it helps with regulatory requirements by demonstrating proactive security measures.
For more information about our services and how we can help you strengthen your cybersecurity defenses, visit our website at HYDN.
