Bybit under attack: the largest cryptocurrency theft in history

On February 21, 2025, the cryptocurrency exchange Bybit experienced an unprecedented cyberattack, with the theft of 1.5 billion dollars in Ether (ETH). 

This event has shaken the crypto sector, once again highlighting the vulnerabilities of digital security. Investigations suggest the involvement of the Lazarus group, known for its cybercrime operations linked to North Korea.  

How did the attack on the Bybit exchange occur?

The hackers have targeted one of Bybit’s most secure assets: the cold wallet, designed to protect funds offline. 

However, through sophisticated phishing attacks, the malicious actors have compromised the transaction signers, leading them to sign fraudulent operations. This method, known as “social engineering”, exploits human error rather than flaws in computer systems.  

The attack demonstrates that, despite the use of wallet offline, security remains vulnerable if access protocols are not adequately protected. 

The hackers were able to deceive the authorized personnel, obtaining the necessary signatures to transfer the 1.5 billion dollars in ETH.

Preliminary investigations indicate that the group Lazarus, an organization of cybercriminals with alleged ties to North Korea, could be behind the attack. 

This group is known for orchestrating some of the largest cyber attacks in the crypto sector, accumulating billions of dollars in recent years.  

Lazarus uses advanced techniques of spear phishing, malware, and targeted attacks against financial platforms. The theft on Bybit is part of a broader picture of illicit activities aimed at financing North Korean government operations, circumventing international sanctions.  

The techniques used by hackers for the theft of 1.5 billion dollars  

The attack on Bybit was carried out using sophisticated methods, combining targeted phishing, social engineering, and compromise of access keys.  

• – Advanced phishing: Hackers sent fraudulent communications to key employees of the exchange, prompting them to reveal sensitive information.  
• – Manipulation of digital signatures: Once access to the signatories was obtained, they exploited the transaction authorization system to transfer funds to addresses controlled by the aggressors.  
• – Washing of stolen funds: To avoid tracking, the stolen funds were divided into multiple wallets and transferred through mixers and anonymization services.  

These operations demonstrate detailed planning and a level of execution typical of well-organized groups like Lazarus.  

The involvement of Chainalysis and law enforcement  

After the attack, Bybit collaborated with Chainalysis, one of the leading companies in blockchain analysis, to trace the path of the stolen funds.

Chainalysis uses advanced tools to monitor transactions on the blockchain, identifying suspicious movements and reporting operations to the competent authorities.  

International law enforcement agencies are already working to block the stolen assets and identify those responsible. However, the recovery of the funds could prove to be complex, as the hackers use sophisticated techniques to obscure the traces.  

The attack on Bybit highlights the need to improve security strategies for cryptocurrency exchanges. Some critical aspects to strengthen include:  

• – Personnel training: Phishing attacks exploit human error. Advanced training programs can reduce the risk of compromise.  
• – More secure multi-signature authentication: Increasing the number of approvals required for high-value transactions can reduce the risk of similar attacks.  
• – Real-time monitoring: The use of blockchain analysis tools like those from Chainalysis can facilitate the timely identification of suspicious activities.  

The crypto sector must quickly adapt to increasingly sophisticated threats, improving defenses against expert hacker groups.  

Impact of the Bybit attack on the bull and bear cryptocurrency sector  

The theft of 1.5 billion dollars in ETH represents a severe blow to confidence in the cryptocurrency sector. Events of this magnitude can influence financial regulators, pushing towards stricter regulations to protect investors.

Users and exchange platforms will need to adopt more advanced security measures, reducing reliance on single points of vulnerability. 

The collaboration between exchanges, blockchain analysis companies, and law enforcement will be essential to counter future threats.