In this news:
“Unfortunately, this transaction was manipulated through a sophisticated attack that masked the signing interface, displaying the correct address while altering the underlying smart contract logic,” Bybit said in a post on social media platform X.
Related StoriesFDIC Acting Chair Says Crypto-Related Regulations for Banks Will Be Revamped2/5/2025SEC Launches Task Force to Overhaul Crypto Policy1/22/2025
“Even if this hack loss is not recovered, all of the client’s assets are 1 to 1 backed—we can cover the loss,” Zhou wrote on X.
“Please rest assured that all other cold wallets are secure,” he wrote in a separate post, emphasizing that all withdrawals are operating normally. “If any team can help us to track the stolen fund will be appreciated.”
Blockchain security analysts, including Elliptic and Arkham Intelligence, have traced the attack to the Lazarus Group, a notorious cybercrime gang allegedly run by the government of North Korea.
Independent investigator ZachXBT further connected the Bybit hack to the Jan. 23 attack on Phemex, a crypto exchange that saw $29 million in digital assets drained. The same Lazarus Group-affiliated digital wallets were used in both attacks, ZachXBT said.
Lazarus Group has been accused of executing dozens of cryptocurrency heists to generate illicit revenue for North Korea’s heavily sanctioned communist regime. In 2024, Google identified North Korea as “arguably the world’s leading cyber criminal enterprise.”
Chainalysis also noted that attacks yielding $100 million or more occurred significantly more often in 2024 than in previous years. The change could mean that North Korean cybercriminals are “getting better and faster at massive exploits,” the report said.
On Jan. 14, the governments of the United States, Japan, and South Korea issued a joint statement warning about North Korea’s escalating cybercrime campaigns. The three countries accused Pyongyang of using stolen digital assets to fund its nuclear and ballistic missile programs.
