Bybit and Ronin hacks: North Korea's billion-dollar heists

What happened to Bybit and Ronin? In March 2022 hackers took about 625 million dollars from the Ronin bridge behind the game Axie Infinity after stealing 5 of its 9 validator keys; one way in was a fake job offer. On 21 February 2025 the exchange Bybit lost about 1.5 billion dollars in ether – the largest crypto theft ever recorded – when the wallet software its staff used showed them a fake transaction. The FBI and the US Treasury attribute both attacks to North Korea's Lazarus Group.

Most bank robbers need a getaway car. North Korea's best ones need a LinkedIn profile, a convincing PDF and a lot of patience.

Who is Lazarus Group?#

Lazarus Group is the name security researchers use for state-backed hacking teams of North Korea. The FBI calls the part that hunts crypto companies TraderTraitor. According to a 2024 report of the UN Security Council's Panel of Experts, the panel was investigating 58 suspected North Korean cyberattacks on crypto firms between 2017 and 2023, worth about 3 billion dollars, and the stolen money helps fund the country's weapons of mass destruction programmes. This is not a teenager in a hoodie – it is a government department with targets.

What happened to Ronin? (March 2022)#

Ronin is a blockchain built for Axie Infinity, a play-to-earn game that was hugely popular in 2021. To move money between Ethereum and Ronin, players used the Ronin bridge. Withdrawals from the bridge needed signatures from 5 of 9 validators.

1. The bait. According to later reports, a senior engineer at Sky Mavis, the company behind the game, was approached about a well-paid job. After several rounds of "interviews" he received the offer as a PDF – and the file infected his computer.
2. Four keys. From inside the company network the attackers reached the four validator keys run by Sky Mavis.
3. The fifth key. In late 2021 Sky Mavis had been allowed to sign on behalf of a fifth validator run by the Axie DAO. That permission was meant to be temporary, but nobody switched it off. Five of nine.
4. The withdrawal. On 23 March 2022 the attackers signed two withdrawals for themselves: 173,600 ETH and 25.5 million USDC, about 625 million dollars at the time.
5. Silence. Nobody noticed for six days. The theft came out on 29 March, when a user could not withdraw 5,000 ETH from the empty bridge.

Sky Mavis raised 150 million dollars in a round led by Binance, used its own reserves to cover users and reopened the bridge on 28 June 2022 with more validators and stricter limits.

What happened to Bybit? (February 2025)#

Bybit, one of the largest crypto exchanges, kept most of its ether in a cold multisig wallet: moving funds needed several employees to approve the transaction, using the popular Safe{Wallet} interface. On paper, a textbook setup.

1. A developer's laptop. According to the investigation by Sygnia and Safe's own report, on 4 February 2025 attackers infected the Mac of a Safe{Wallet} developer and got access to the company's cloud account.
2. A poisoned website. On 19 February they quietly changed the JavaScript of the Safe{Wallet} web interface. The malicious code activated only when Bybit's wallet was in use – everybody else saw the normal page.
3. The routine transfer. On 21 February Bybit's signers approved what looked like an ordinary transfer from cold to hot wallet. Their screens showed the right address. Their hardware wallets showed data they could not really read – blind signing.
4. The real transaction. In reality they signed a change of the wallet's logic that handed control to the attackers, who swept out about 401,000 ETH plus other ether-based tokens – roughly 1.5 billion dollars.
5. Cleanup. About two minutes later the attackers removed the malicious code from the website.

What happened next surprised many: Bybit stayed open. CEO Ben Zhou announced the hack himself within hours and said client assets remained fully backed. Within days the exchange closed the gap with loans from other firms and large purchases of ETH, and it offered a bounty of up to 10 % for help freezing the stolen coins. On 26 February 2025 the FBI publicly named North Korea's TraderTraitor as the culprit.

How is the loot laundered?#

Stealing crypto is the easy half. Turning it into usable money is harder, because every movement on a public blockchain is visible. Lazarus uses a well-practised routine:

• Split the coins across thousands of addresses so tracking takes longer.
• Swap and hop between blockchains – with Bybit, most of the ETH was converted to bitcoin through the cross-chain protocol THORChain within about ten days.
• Mix coins through mixers and services that ask no questions. The US Treasury sanctioned the mixer Blender.io in 2022 for laundering part of the Ronin money.
• Cash out slowly through brokers and accounts in countries with weak oversight.

Some funds are frozen along the way – but as of March 2025 Bybit's CEO said about 20 % had already "gone dark".

Timeline#

Lazarus did not stop there. Investigators also tie it to the Harmony bridge (about 100 million dollars, 2022), the Japanese exchange DMM Bitcoin (about 300 million dollars, 2024) and the Kelp DAO bridge (about 292 million dollars, April 2026) – more in the lesson Bridges and their hacks.

Warning signs you could have seen#

• A dream job offer out of nowhere. Recruiters who move fast, pay too well and send files or "test tasks" to run are a classic Lazarus opening. The same trick hits crypto users and freelancers.
• Few keys guarding huge money. Five keys out of nine, most of them held by one company, protected 600 million dollars. Count who really controls the keys.
• Permissions nobody remembers. The Ronin hole was a temporary access left switched on.
• Signing what you cannot read. Bybit's signers trusted a screen. If your hardware wallet cannot show you clearly what you approve, stop.
• Silence. If nobody notices a 600-million-dollar hole for six days, nobody is watching.

Sources#

• FBI: North Korea responsible for 1.5 billion USD Bybit hack (2025) (opens in a new tab)
• Sygnia: Investigation into the Bybit hack (opens in a new tab)
• US Treasury: Sanctions on the mixer Blender.io, Ronin theft (2022) (opens in a new tab)
• Chainalysis: 2025 crypto crime mid-year update (opens in a new tab)
• ABC News: UN report on North Korea's crypto theft and weapons funding (2024) (opens in a new tab)