Contents
In short: on 21 February 2025, hackers the FBI attributes to North Korea took about 401,000 ether, roughly $1.5 billion, from the exchange Bybit in a single transaction. The laundering came in three steps. Split: within two hours the ether sat in 50 wallets, then moved on through more and more addresses, the peel-chain way Lazarus has laundered before. Change form: through swap services, mostly ones using THORChain, the ether became bitcoin, and in nine days all 50 wallets were empty. Into the dark: mixers, then addresses already holding loot from older North Korean hacks. On day five the FBI named North Korea and asked exchanges and bridges to block the addresses.
The theft: one transaction
The FBI: "North Korea was responsible for the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange, Bybit, on or about February 21, 2025." Chainalysis puts it at "approximately 401,000 ETH".
The way in went through Safe{Wallet}, the multi-signature service Bybit used. Sygnia found that "a macOS workstation belonging to a Safe{Wallet} developer… was compromised on February 4, 2025", and that code planted in Safe's web interface had "an activation condition, set to execute the transaction manipulation only on a specific Bybit's cold wallet". So "the Safe{Wallet} user interface displayed legitimate transaction data while malicious transactions were signed and executed."
Step 1: split it, then peel it
Elliptic: "Within two hours of the theft, the stolen funds were sent to 50 different wallets, each holding approximately 10,000 ETH."
Then the trail gets longer. A peel chain, in the words of a 2020 summary of a US Justice Department complaint: "a single address begins with a relatively large amount of cryptocurrency. A smaller amount is then "peeled" off this larger amount… and the remainder is transferred to a one-time change address. This process is repeated – potentially hundreds or thousands of times". It is an old Lazarus method. Chainalysis, on that 2020 case: "Lazarus collaborated with Tian and Li to launder the stolen cryptocurrency, conducting hundreds of transactions and forming peel chains that further obfuscated the path of funds."
We have not seen a source that traces a peel chain in the Bybit funds specifically, so the chain in the video is illustrative. What the FBI did say: the stolen assets were "dispersed across thousands of addresses on multiple blockchains."
Day 5: the FBI
On 26 February the FBI named North Korea ("FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor"") and listed the addresses: "The following Ethereum addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors". We count 51 of them; the notice gives no number.
Its request: "FBI encourages private sector entities including RPC node operators, exchanges, bridges, blockchain analytics firms, DeFi services, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder the stolen assets."
Step 2: change its form
TRM Labs, on 3 March: "All of the stolen ETH has now been moved to new addresses, with the vast majority bridged to Bitcoin, mostly via services using THORchain." Elliptic adds the clock: the 50 wallets "were then emptied one by one over the next nine days. The last of the original 50 wallets holding the stolen funds was emptied on 3rd March."
Step 3: into the dark
TRM: "We have now entered that second phase and have seen an initial tranche of Bybit's BTC being deposited to mixers including Wasabi and CryptoMixer." Elliptic: "this bitcoin has now begun to be passed through mixers, to further obfuscate the transaction trail."
And the money joined older money. Chainalysis: "Funds from the Bybit exploit have also consolidated in addresses holding funds from other known DPRK-linked attacks, providing further evidence that the nation state actors are behind this latest incident."
Then cash, and what it pays for
The last step is turning crypto into money that can be spent. Among the patterns the UN Panel of Experts lists: "Heavy reliance on third party launderers and over-the-counter brokers". And the US Treasury sanctioned "a PRC-based OTC virtual currency trader who facilitated the conversion of virtual currency stolen by DPRK actors working with the Lazarus Group to fiat currency."
What for? The same UN report: "A second Member State reported that 40 per cent of the weapons of mass destruction programmes … are funded by illicit cybermeans." That is one country's figure given to the Panel, not the Panel's own finding.
How it usually starts
Not with code, with a message. CISA: "The messages often mimic a recruitment effort and offer high-paying jobs to entice the recipients to download malware-laced cryptocurrency applications". Among the FBI's warning signs: "Requests to conduct a 'pre-employment test' or debugging exercise that involves executing … scripts, or GitHub repositories."
- Don't run code a stranger sends you, however good the job offer.
- Before you sign, read the transaction on the device itself, not on the web page that asked for it.
Sources
- FBI IC3, North Korea Responsible for $1.5 Billion Bybit Hack, 26 Feb 2025
- Elliptic, The largest theft in history: following the money trail from the Bybit hack, Feb–Mar 2025
- TRM Labs, Bybit hack update: North Korea moves to next stage of laundering, 3 Mar 2025
- Chainalysis, Collaboration in the wake of record-breaking Bybit theft, 24 Feb 2025
- Chainalysis, New OFAC sanctions and DOJ complaint for North Korea-linked cryptocurrency laundering scheme, 5 Mar 2020
- Money Laundering Watch, Two Chinese nationals charged with laundering over $100 million in cryptocurrency for North Korea, 11 Mar 2020
- Sygnia, Sygnia's investigation into the Bybit hack
- UN Panel of Experts, S/2024/215, 7 Mar 2024
- US Treasury, jy1435, 24 Apr 2023
- CISA, AA22-108A: TraderTraitor; FBI, PSA 240903, 3 Sep 2024
The video is animated with code and the script was written with AI assistance; every quote above is checked against its source, and the count of 51 addresses is ours. Illustrative: the wallet addresses, the per-hop amounts, the peel chain, the screens and the messages. This post explains the laundering at the level the FBI and the analysts describe it, not how to do it. Made with Shotloop, my free Mac app for code-made explainers, fixed one shot at a time.