North Korean hackers believed to be part of the infamous Lazarus Group have successfully drained at least $300 million from their notable crypto heist totaling $1.5 billion. The major breach occurred at the crypto exchange ByBit two weeks prior and has prompted a sustained effort to trace and restrict the hackers from converting the digital assets into cash that is unusable.
Experts indicate that this elite hacking team is operating around the clock, possibly directing funds toward military enhancements for the North Korean regime. “Every minute counts for these hackers as they aim to obscure their financial footprint,” stated Dr. Tom Robinson, co-founder of the cryptocurrency investigative firm Elliptic. Dr. Robinson further emphasizes that North Korea exhibits exceptional talent in laundering cryptocurrency, attributing it to considerable expertise and experience; he suspects that an entire team is dedicated to this operation, working in shifts to ensure continuous activity.
According to Elliptic’s detailed analysis, ByBit has reported that 20% of the stolen funds have “gone dark,” making recovery highly unlikely. The U.S. and allied nations have accused North Korea of executing numerous hacks in recent years as a means to financially support its military programs. A critical breach occurred on February 21, where the attackers hijacked a supplier's system to covertly redirect a transfer of 401,000 Ethereum coins intended for ByBit’s wallet.
ByBit’s CEO, Ben Zhou, has reassured customers that their individual funds remain intact. The company has initiated a bounty program named Lazarus Bounty to encourage public assistance in tracing the illicit funds, offering rewards for identifying significant portions of the stolen money. The program has already led to rewards exceeding $4 million for those who have helped identify around $40 million of the plundered crypto.
However, experts remain pessimistic about recovering the remainder of the funds due to North Korea’s proficiency in cybercrime and laundering activities. The clandestine nature of North Korea's economy has led to a polished industry focused on these illicit practices, with no concern for reputational fallout. Additionally, not all crypto platforms are cooperative; ByBit has accused eXch of facilitating the laundering by allowing over $90 million to be cycled through its system. The eXch operator, Johann Roberts, contends that his team was uncertain of the funds' origins and is working to improve cooperation.
Although North Korea has not formally claimed ownership of the Lazarus Group, it is acknowledged as the only nation leveraging hacking efforts for financial gain. This hacking unit has increasingly targeted the cryptocurrency sector, which remains more vulnerable compared to traditional financial institutions. Previous notable attacks attributed to North Korea include the $41 million UpBit breach in 2019 and the infamous Ronin Bridge hack that siphoned off $600 million in crypto last year. While the U.S. has designated members of the Lazarus Group to its Cyber Most Wanted list, the likelihood of apprehending these individuals is negligible unless they leave North Korean borders.
