Lazarus Group hackers may be behind the largest cryptocurrency hack in history

The stolen funds after the large-scale hack of the Bybit crypto exchange are likely to be laundered through mixers to hide the traces of transactions. This was reported by the analytical company Elliptic, which links the attack to the Lazarus hacker group supported by the North Korean government. It notes that this method is used by attackers regularly, although this time the difficulty lies in the amount of stolen assets.

After the attack on February 21, the attackers stole about $ 1.46 billion in cryptocurrency. This is the largest hack in the history of the industry, surpassing the attacks on Poly Network in 2021 and Ronin Network in 2022. Lazarus usually first exchanges the stolen tokens for ETH and then begins a complex process of «layering» — moving funds between different wallets, using interconnect bridges and decentralized exchanges.

Two hours after the attack, the assets were distributed among 50 crypto wallets, each of which received 10,000 ETH. Elliptic recorded that at least 10% of the stolen funds have already begun to be moved. The main channel of laundering was the eXch platform, which, according to analysts, does not respond to requests to block suspicious transactions. However, the platform itself denies any involvement in the process.

Lazarus Group has repeatedly used similar methods. From 2020 to 2023, they laundered more than $ 200 million through mixers and P2P marketplaces. Recently, however, they have been increasingly using inter-network bridges, which makes it difficult to track transactions.

Meanwhile, Bybit is trying to recover its lost assets. The exchange’s CEO Ben Zhou said that the company has fully compensated for the $ 1.4 billion loss. A new reserve report is planned to be published in the near future, which will confirm that the company has 100% of its assets covered.