Imagine waking up to find that a single nation-state just stole more money from your bank account than most countries earn in foreign currency for the year. That is essentially what happened on February 21, 2025. Bybit, one of the world’s largest cryptocurrency exchanges, lost approximately $1.5 billion worth of Ethereum. This wasn’t some script kiddie finding a bug in a smart contract. It was a coordinated, state-sponsored raid by North Korea.

The FBI later named the specific hacking unit responsible "TraderTraitor." But who are they? Why did they pick Bybit? And how does a country under heavy sanctions manage to pull off the biggest crypto heist in history? Let’s break down the mechanics of this massive breach and what it means for your digital assets.

What Exactly Happened at Bybit?

On the morning of February 21, 2025, users noticed something odd. Withdrawals were stalling. Then, the numbers started dropping fast. Within hours, about $1.5 billion in ETH vanished from Bybit’s cold storage wallets. For those not familiar with crypto infrastructure, cold wallets are supposed to be offline-disconnected from the internet to prevent hackers from reaching them. So, how do you steal from a box that isn’t plugged into the wall?

The answer lies in the human element and the supply chain. According to blockchain analytics firm TRM Labs, the attackers didn’t just guess a password. They compromised the signing process itself. Whether through an insider threat or a sophisticated supply chain attack, the hackers gained access to the private keys required to authorize transactions. Once they had those keys, they signed multiple large transactions and moved the funds out rapidly.

This event nearly doubled North Korea’s total crypto thefts from the previous year. In 2024, the regime stole around $800 million across 47 incidents. This single heist eclipsed all of that combined. It shows a shift in strategy: instead of many small bites, they went for one giant gulp.

Who Is TraderTraitor?

You might have heard of the Lazarus Group. It’s the umbrella term for North Korean cyber operations linked to the Reconnaissance General Bureau (RGB). But Lazarus is too broad. The FBI specifically attributed the Bybit hack to a subunit called TraderTraitor.

TraderTraitor has been active since at least 2022. Unlike earlier groups that relied heavily on phishing emails or malware, this unit focuses on high-value targets using advanced persistent threat techniques. They target centralized exchanges because these platforms hold billions in liquid assets. Traditional banks have layers of physical and regulatory security; crypto exchanges often rely on code and protocol, which can be brittle if not perfectly maintained.

The Technical Breakdown: How Did They Bypass Cold Storage?

This is the part that keeps CTOs awake at night. If your keys are offline, how did they get stolen? The investigation points to three likely vectors, though the exact root cause remains partially obscured:

• Supply Chain Attack: The hackers may have compromised a third-party service provider used by Bybit for key management or transaction signing. If the tool you use to sign transactions is infected, your offline status doesn’t matter.
• Insider Threat: A rogue employee could have leaked private keys or manipulated the multi-signature approval process. State actors are excellent at recruiting insiders through financial incentives or coercion.
• Private Key Compromise: Advanced techniques allowed the attackers to extract keys from memory or secure enclaves during the signing process, even if the device wasn’t directly connected to the public internet.

Once the keys were compromised, the speed of execution was terrifying. The attackers didn’t wait. They moved the ETH immediately. Then came the laundering phase. You can’t just spend stolen ETH easily without raising flags. So, they converted it.

The Money Trail: From Ethereum to Bitcoin

TRM Labs tracked the movement of the stolen funds in real-time. Here is the path the money took:

1. Initial Extraction: ~$1.5 billion in ETH left Bybit’s hot and cold wallets.
2. Cross-Chain Bridges: The hackers used bridges to move assets between blockchains. Some ETH was swapped on decentralized exchanges (DEXs) on networks like Binance Smart Chain and Solana.
3. Conversion to BTC: The majority of the funds were eventually converted into Bitcoin. Why Bitcoin? It’s the most liquid asset in crypto. It’s easier to sell OTC (over-the-counter) in large blocks without crashing the price as severely as selling a huge chunk of altcoins would.
4. Obfuscation: The funds were split across thousands of addresses. This "flood the zone" tactic overwhelms compliance teams trying to track every single hop.

Interestingly, after the initial scramble, much of the converted Bitcoin remained stationary. This suggests the hackers weren’t desperate to cash out immediately. They might be holding the assets, waiting for a better market condition, or moving them through complex OTC deals that don’t show up on-chain.

Why Does North Korea Steal Crypto?

It’s not just about greed. It’s about survival. North Korea faces severe international sanctions. They need foreign currency to fund their nuclear weapons program and maintain the lifestyle of the elite. Traditional banking channels are closed to them. They can’t easily wire money from New York to Pyongyang.

Crypto solves this problem. It allows value transfer without intermediaries. Estimates suggest that up to 50% of North Korea’s foreign-currency earnings now come from cybercrime. The UN has reported that these thefts directly support the DPRK’s weapons development. When you buy Bitcoin, you might inadvertently be funding a missile test.

Impact on the Crypto Industry and Security Standards

The Bybit hack shattered the illusion that cold storage is impenetrable. For years, exchanges told users, "Your coins are safe because we keep them offline." This incident proved that operational security matters just as much as technical isolation.

In response, the industry is shifting:

• MPC Wallets: More exchanges are moving toward Multi-Party Computation (MPC) technology. Instead of one private key, the key is split into shards held by different parties. An attacker needs to compromise multiple independent systems simultaneously to sign a transaction.
• Real-Time Monitoring: Firms like TRM Labs and Chainalysis are becoming mandatory partners for exchanges. They provide real-time alerts when suspicious patterns emerge.
• FBI Collaboration: The FBI released specific wallet addresses associated with TraderTraitor. They asked RPC node operators and other exchanges to block transactions from these addresses. This level of cooperation between law enforcement and private tech firms is new and crucial.

What Should Investors Do?

If you hold crypto on an exchange, ask yourself: Do I trust their security architecture? The Bybit hack reminds us that "not your keys, not your coins" is still the golden rule. While major exchanges have insurance policies, recovering full losses from a $1.5 billion hole takes time.

For long-term holders, consider moving significant amounts to hardware wallets where you control the seed phrase. For traders, diversify your holdings across multiple reputable exchanges. Don’t put all your eggs in one basket, especially when that basket is targeted by a national intelligence agency.

Frequently Asked Questions