The attack compromised Bybit's cold wallet, an offline storage system designed for security.
The stolen funds, primarily in Ethereum, were swiftly transferred to multiple wallets and liquidated through various platforms.
“Please rest assured that all other cold wallets are secure,” wrote Ben Zhou, CEO of Bybit. “All withdrawals are proceeding normally.”
Blockchain analysis firms, including Elliptic and Arkham Intelligence, tracked the movement of the stolen cryptocurrency to various accounts and its rapid withdrawal. According to Elliptic, this hack significantly surpasses previous major thefts in the sector. This includes $611 million stolen from Poly Network in 2021 and $570 million withdrawn from Binance in 2022.
Later, Elliptic analysts linked the attack to North Korea's Lazarus Group—a state-sponsored hacking organization known for siphoning billions of dollars from the cryptocurrency industry. The group is recognized for exploiting security vulnerabilities to fund the North Korean regime, often employing sophisticated money laundering techniques to obscure their movements.