From Breach to Recovery: How Lazarus Group Laundered $1.5B from Bybit – and How the Exchange Fought Back

When the Lazarus Group executed a staggering $1.5 billion heist on cryptocurrency exchange Bybit, it sent shockwaves throughout the digital asset world. The North Korean-backed hackers exploited internal wallet transfer processes, siphoning off vast amounts of Ethereum (ETH) and Lido Staked Ether (stETH). This incident now stands as the largest cryptocurrency exchange hack to date. The attackers moved swiftly, laundering hundreds of millions through decentralized protocols and intricate cross-chain swaps. However, Bybit’s response was equally rapid. Within just 72 hours, the exchange replenished its reserves through a combination of bridge loans, OTC market acquisitions, and a crucial $600 million ETH infusion from Mirana Ventures. With withdrawals fully restored and a bounty program launched to recover stolen assets, Bybit’s handling of the crisis has been met with both industry praise and critical scrutiny.

This piece delves into both sides of the story: the Lazarus Group’s sophisticated laundering operation and Bybit’s aggressive recovery efforts. It wants to shed light on the challenges centralized platforms face in an era of increasingly advanced crypto crimes.

Attribution of the Hack: How Did It Happen and Who Was Responsible?

Multiple cybersecurity investigations, including those by Chainalysis, Elliptic, and TRM Labs, have attributed the Bybit hack to the Lazarus Group – a state-sponsored cybercrime syndicate operating under North Korean intelligence. Known for previous attacks on major platforms like Axie Infinity’s Ronin Bridge and Harmony Protocol, Lazarus Group’s latest operation leveraged a vulnerability during a routine transfer between Bybit’s cold and hot wallets.

Reports indicate that the hackers initiated unauthorized transactions during this window. They rerouted over $1.5 billion worth of ETH and stETH to addresses under their control. Although the specific infiltration method remains under investigation, early findings suggest a combination of social engineering tactics and compromised internal processes may have been exploited. Notably, sophisticated phishing attempts targeted several Bybit employees, although Bybit has not confirmed whether these were the direct entry points.

Following the Money: Lazarus Group’s Laundering Tactics

Within hours of securing the stolen funds, the Lazarus Group began an elaborate laundering process to obscure the asset trail. Blockchain analytics firms have traced approximately 89,500 ETH (worth around $224 million) already laundered within 60 hours of the breach.

Key Laundering Techniques Employed:

• Decentralized Exchange (DEX) Swaps: Lazarus utilized decentralized protocols such as THORChain and Uniswap to convert ETH into multiple tokens across different blockchains, bypassing centralized compliance systems.
• Cross-Chain Bridges: The stolen assets were transferred across networks like Binance Smart Chain, Avalanche, and Tron. This makes the funds more difficult to trace.
• Peel Chains: Funds were moved in incremental amounts through thousands of intermediary wallets, a tactic designed to complicate tracking efforts.
• Use of Mixers: Despite increased regulatory scrutiny and sanctions, services like Tornado Cash were used in earlier laundering phases to obscure transaction origins.

Analysts believe that approximately 82% of the stolen assets remain in wallets controlled by Lazarus. Global law enforcement entities and blockchain intelligence firms will continue surveilling these wallets.

Bybit’s Response and Recovery Efforts

Immediate Crisis Management and Bounty Launch

Within hours of detecting the breach, Bybit suspended withdrawals to prevent further losses and initiated an emergency incident response plan. Shortly thereafter, the exchange offered a bounty of up to 10% of any recovered funds, incentivizing cybersecurity experts and ethical hackers to assist in the recovery operation.

Full Restoration of Exchange Services

Despite the scale of the breach, Bybit resumed withdrawal services within 48 hours and restored full functionality across its platform by February 26, 2025. According to company reports, over 580,000 withdrawal requests were processed successfully, covering approximately 99.9% of pending transactions.

Replenishing the ETH Reserves: A Three-Pronged Strategy

Bybit’s ability to recover and secure liquidity in under three days involved a multifaceted approach:

• Bridge Loans from Institutional Partners: To address immediate liquidity gaps, Bybit secured short-term bridge loans from private investment groups, covering approximately 80% of the stolen ETH.
• OTC Acquisitions: Bybit purchased approximately 157,660 ETH through over-the-counter deals facilitated by liquidity providers such as Galaxy Digital and Wintermute. These transactions minimized market disruption while ensuring rapid replenishment.
• $600 Million ETH Infusion from Mirana Ventures: Mirana Ventures, an investment arm closely tied to Bybit’s leadership, played a critical role in the recovery process. The firm liquidated $500 million in Bitcoin (BTC) and $100 million in Tether (USDT) through a combination of OTC desks and direct market purchases to secure the necessary ETH. This strategic partnership allowed Bybit to rapidly close the liquidity gap.

Industry Reaction: Applause and Criticism

The crypto industry’s response to Bybit’s crisis handling has been mixed. On one hand, leading blockchain security firms like Chainalysis and Elliptic praised the exchange’s transparency and swift action. They cited their collaborative approach, working alongside law enforcement and cybersecurity experts as a model for future incident response protocols.

However, skepticism remains. Critics argue that the hack exposes broader vulnerabilities inherent in centralized exchanges. Cybersecurity experts have pointed out that internal process audits and enhanced wallet transfer protocols could have prevented the breach. Calls for stricter industry-wide security standards and greater transparency in internal operations have grown louder in the wake of the attack.

Financial analysts also raised eyebrows at Bybit’s ability to secure such large sums so quickly, prompting questions about the exchange’s reliance on affiliated entities like Mirana Ventures for emergency liquidity.

The Bybit hack is more than just another entry in the growing list of crypto-related cyberattacks. It’s a pivotal moment that underscores the sophistication of modern-day cybercrime and the immense challenges facing centralized platforms. Lazarus Group’s use of decentralized tools and cross-chain solutions highlights the evolving complexity of blockchain-based laundering operations. At the same time, Bybit’s rapid response showcases the resilience possible with coordinated industry partnerships and swift internal action.

Yet, questions linger. Can centralized exchanges balance user convenience with the level of security required to thwart future threats? Will the crypto industry take this incident as a wake-up call to tighten operational security, or will history repeat itself?

For now, Bybit’s comeback is both a cautionary tale and a testament to what’s possible when crisis management and industry cooperation align.