On February 21, 2025, Bybit, a prominent cryptocurrency exchange, experienced a significant security breach resulting in the loss of nearly…
The post Leveraging Transparency for Collaboration in the W...

On February 21, 2025, Bybit, a prominent cryptocurrency exchange, experienced a significant security breach resulting in the loss of nearly $1.5 billion worth of ether (ETH). This incident stands as the largest digital heist in the history of cryptocurrency. Fortunately, Bybit is actively collaborating with industry experts, including Chainalysis, to trace the stolen assets. They have also launched a recovery bounty program, <a href="https://markets.businessinsider.com/news/stocks/bybit-launches-recovery-bounty-program-with-rewards-up-to-10-of-stolen-funds-1034394717" rel="nofollow">offering up to 10%</a> of the recovered amount to individuals who assist in retrieving the stolen crypto.In this blog, we’ll look at how the exploit occurred; the attackers’ tactics, techniques, and procedures (TTPs) and their consistency with the Democratic People’s Republic of Korea (DPRK); and how Chainalysis is collaborating with Bybit and law enforcement to help recover funds.<h2>Details of the Bybit exploit</h2>The Bybit hack serves as a stark reminder of the evolving tactics employed by state-sponsored cybercriminals, particularly those linked to the DPRK. As we recently revealed in our <a href="https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2025/" rel="nofollow">2025 Crypto Crime Report</a>, North Korea-affiliated hackers stole approximately $660.5 million across 20 incidents in 2023. In 2024, this number increased to $1.34 billion stolen across 47 incidents — a 102.88% increase in value stolen. The Bybit hack alone led to almost $160 million more stolen than all funds stolen by North Korea throughout 2024.This attack highlights a common playbook used by the DPRK: orchestrating social engineering attacks and employing intricate laundering methods in an attempt to move stolen funds undetected. Funds from the Bybit exploit have also consolidated in addresses holding funds from other known DPRK-linked attacks, providing further evidence that the nation state actors are behind this latest incident.Below is a step-by-step analysis of how the Bybit exploit unfolded: <ol><li>Initial compromise via social engineering: The hackers gained access to Bybit’s user interface by executing phishing attacks against the cold wallet signers, leading them to sign malicious transactions that replaced the Safe’s multi-signature wallet implementation contract with a malicious one.</li><li>Initiation of unauthorized transfers: During what appeared to be a routine transfer from Bybit’s Ethereum cold wallet to a hot wallet, the attackers intercepted the process. They managed to reroute approximately 401,000 ETH — valued at nearly $1.5 billion at the time of the exploit — to addresses under their control.</li><li>Asset dispersion through intermediary wallets: The stolen assets were then moved through a complex web of intermediary addresses. This dispersion is a common tactic used to obfuscate the trail and hinder tracking efforts by blockchain analysts.</li><li>Conversion and laundering: The hackers swapped significant portions of the stolen ETH for tokens including BTC and DAI. They also utilized decentralized exchanges (DEXs), cross-chain bridges, and a no-KYC instant swap service to move assets across networks.</li><li>Keeping funds dormant and strategic laundering: A notable portion of the stolen funds has remained idle across various addresses, a deliberate move often employed by North Korea-affiliated hackers. By delaying laundering efforts, they aim to outlast the heightened scrutiny that typically immediately follows such high-profile breaches.</li></ol>The below <a href="http://reactor.chainalysis.com/" rel="nofollow">Chainalysis Reactor</a> graph showcases the complexity of the laundering efforts thus far: the web of intermediary addresses, token swaps, and cross-chain movements that not only attempt to obscure the stolen funds, but also demonstrate the far-reaching consequences of this exploit across the broader crypto ecosystem.<img src="https://static.fwimg.io/img/feed/1d2a60a9fcabf5012f3d3d5e19114f9f.jpg" alt=""><h2>Industry collaboration in the wake of the Bybit hack</h2>Despite the severity of Bybit’s attack, the inherent transparency of blockchain technology presents a significant challenge for malicious actors attempting to launder stolen funds. Every transaction is recorded on a public ledger, enabling authorities and cybersecurity firms to trace and monitor illicit activities in real time.Collaboration across the crypto ecosystem is paramount in combating these threats. The swift response from Bybit, including its assurance to <a href="https://www.coindesk.com/business/2025/02/21/bybit-experiences-usd1-46b-in-suspicious-outflows-zachxbt" rel="nofollow">cover customer losses</a> and its engagement with blockchain forensic experts, exemplifies the industry’s commitment to mutual support and resilience. By uniting resources and intelligence, the crypto community can strengthen its defenses against such sophisticated cyber attacks and work toward a more secure digital financial environment.We are working with our global teams, customers, and partners across both the public and private sectors to support multiple avenues for seizure and recovery in response to this attack. Already, we’ve worked with contacts in the industry to help freeze more than $40 million in funds stolen from Bybit and continue to collaborate with public and private sector organizations to seize as much as possible. We will continue to provide updates on this matter.<div><a href="https://go.chainalysis.com/2025-Crypto-Crime-Report.html" rel="nofollow"><h2>The Chainalysis 2025 Crypto Crime Report </h2>Reserve your copy</a><a href="https://go.chainalysis.com/2025-Crypto-Crime-Report.html" rel="nofollow"><img src="https://static.fwimg.io/img/feed/8c8f7f46e385b87fa0921e8686d2002a.jpg" alt=""></a></div>This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein. This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.The post <a href="https://www.chainalysis.com/blog/bybit-exchange-hack-february-2025-crypto-security-dprk/" rel="nofollow">Leveraging Transparency for Collaboration in the Wake of Record-Breaking Bybit Theft</a> appeared first on <a href="https://www.chainalysis.com/" rel="nofollow">Chainalysis</a>.

Leveraging Transparency for Collaboration in the Wake of Record-Breaking Bybit Theft

2025년 2월 21일, 바이비트(Bybit), 유명한 암호화폐 거래소가 심각한 보안 침해를 겪었고, 이로 인해 거의...
이 게시물은 W...에서의 협력을 위한 투명성 활용에 대한 것입니다.

2025년 2월 21일, 주요 암호화폐 거래소인 바이비트(Bybit)가 약 15억 달러 상당의 이더리움(ETH) 손실을 초래하는 중대한 보안 침해를 겪었습니다. 이는 암호화폐 역사상 가장 큰 디지털 절도 사건입니다. 다행히도 바이비트는 차이널리시스를 포함한 업계 전문가들과 적극적으로 협력하여 도난당한 자산을 추적하고 있습니다. 또한 도난 자금 회수에 도움을 준 개인에게 최대 10%의 보상금을 제공하는 회수 보상 프로그램을 시작했습니다.

이 블로그에서는 이 공격이 어떻게 발생했는지, 공격자들의 전술, 기법 및 절차(TTPs)와 이들의 북한(DPRK)과의 연관성, 그리고 차이널리시스가 바이비트와 법 집행 기관과 협력하여 자금 회수를 돕는 방법을 살펴볼 것입니다.

기록적인 바이비트(Bybit) 도난 사건 이후 협업을 위한 투명성 활용

거래소는 대출, 고래 예금 및 직접 구매의 조합을 통해 이더리움(ETH) 부족분을 보충한 것으로 보고되었습니다.

바이비트(Bybit) , 해킹 후 12억 3천만 달러 매수로 Ethereum 적자 마감: CEO

北朝鮮の俳優たちは、<Elliptic>によると、記録的な14億6000万ドルの盗難の少なくとも10%を匿名の<XCH>を通して洗浄し始めています。

바이비트(Bybit) 펀드가 움직이고 있으며, 비트코인 ​​믹서로 향할 수도 있습니다. '다음': Elliptic

암호화폐 가격이 하락하고 있으며, <비트코인>과 <이더리움(ETH)>이 6억 8,600만 달러 규모의 청산을 주도하고 있고, <솔라나(SOL)>과 <도지코인(Doge)>은 두 자릿수 손실을 보이고 있습니다.

기록적인 바이비트(Bybit) 도난 사건 이후 협업을 위한 투명성 활용

앱을 다운로드하고 혜택 이벤트에 참여하기