Lazarus Group Responsible For Bybit’s $1.4 Billion Ethereum Hack: Report

The Lazarus Group, a hacking organization linked to North Korea, has been identified as behind the recent $1.4 billion Ethereum theft from cryptocurrency exchange Bybit. This revelation was made after blockchain investigator ZachXBT provided strong evidence linking the attack to them.

Lazarus Group Implicated in the Bybit Hack

It is worth mentioning that ZachXBT’s investigation found a series of test transactions and connected wallets that led directly to the Lazarus Group. 

The research as shared on X included detailed graphs and time-based analysis, which have been shared with Bybit to help their ongoing investigation.

Meanwhile, Arkham Intelligence, a blockchain data platform, had offered a reward of 50,000 ARKM tokens for information that could identify the hackers. After reviewing ZachXBT’s findings, Arkham confirmed the link to the Lazarus Group. 

They stated that his report included a full breakdown of test transactions, connected wallets, and forensic graphs showing how the attack happened.

The Bybit Exploit: How Bad is it?

Notably, the Bybit hack occurred on Friday, with about 401,346 ETH (worth $1.4 billion) stolen from Bybit’s cold wallet. While cold wallets are supposed to be safe since they are not connected to the internet, the hackers still managed to get in. It shows how desperate the hackers are and how fragile the cryptocurrency market is. This also raises a question of how genuinely decentralized or safe the crypto market is.

On the flip side, reports also show that the stolen funds were transferred to different wallets, and at least $200 million worth of staked Ether (stETH) has already been sold on decentralized exchanges.

In response to the event that has brought mixed feelings among the Bybit community and the cryptocurrency community at large, CEO Ben Zhou took to his page on X and reassured users that the exchange is financially stable and will still function well irrespective of the severity of the attack. Again, he confirmed that all client assets are fully backed and that the exchange remains solvent despite the large loss.

Unfortunately, this attack has also affected the broader digital asset market. Ethereum’s Relative Strength Index (RSI) dropped sharply from 62.8 to 51.6 within hours. This shows a decrease in buying activity as the Lazarus Group carted away with the stolen ETH. 

While the RSI is still above the neutral 50 mark, this drop suggests investors are becoming more cautious. The Altcoin also decreased by 4% moments after the hack. The attack has also affected Bitcoin and other altcoins, with the entire cryptocurrency market capitalization reeling in loss.

Lazarus Group and its Trend in Crypto

In other news, the Lazarus Group has been responsible for some of the biggest hacks in crypto. There is speculation that the North Korean government is supporting the group. Put differently, they are a state tool that is used for stealing funds to bypass economic sanctions. 

In March 2022, they stole about $625 million from the Ronin Network, which is connected to the Axie Infinity game. 

A few months later, in June 2022, it was confirmed by the US. FBI that they had taken $100 million from Harmony’s Horizon bridge. More recently, in 2024, they stole over $300 million from Japan’s DMM Bitcoin exchange. 

Sadly, these attacks show that the Lazarus Group keeps changing its methods to exploit security gaps in cryptocurrency systems. 

The Bybit hack is another warning that stronger security measures are needed to protect digital assets.

In January, the United States, Japan, and South Korea issued a joint statement to address threats from North Korean hackers. The joint statement noted that despite the threats, they are working to disrupt their potency.