- Blockchain investigator ZachXBT traced the attack on Bybit to the North Korean Lazarus Group.
- The hack is allegedly connected to the attack on crypto exchange Phemex in January.
- Bybit CEO Ben Zhou claims the exchange has secured 80% of customers' stolen funds by leveraging bridge loans.
Crypto investigator ZachXBT linked the $1.44 billion hack of crypto exchange Bybit on Friday to the infamous Lazarus Group, which has been allegedly responsible for some of the top attacks on digital asset platforms.
Additionally, Bybit CEO Ben Zhou claimed the exchange had raised nearly 80% of the stolen funds from bridge loans, encouraging users to stay calm.
Lazarus group strikes crypto again, Bybit aims for quick recovery
Crypto investigator ZachXBT claims that the Bybit attack was performed by the North Korean Lazarus Group.
According to a post by Arkham on X, ZachXBT submitted "definitive proof" that linked this recent exploitation to the Lazarus Group.
"His submission included a detailed analysis of test transactions and connected wallets used ahead of the exploit, as well as multiple forensics graphs and timing analysis," Arkham shared in a post on X.
This marks yet another successful attack on top crypto companies by the anonymous group.
ZachXBT also shared in response to Arkham that he connected the attack to that of the Phemex exchange in January, where hackers stole $30 million.
TLDR myself and Josh from CF connected the Bybit hack on-chain to the Phemex hack
— ZachXBT (@zachxbt) February 21, 2025
Arkham offered a bounty of 50,000 ARKM, worth $32,000, to anyone who could identify the perpetrators behind the attack.
This came after Bybit confirmed a major security breach resulting in the loss of $1.44 billion in ETH-related assets, marking one of the largest theft in crypto market history.
In response, co-founder and CEO Ben Zhao assured users that the exchage will honour all withdrawal requests, include those under review.
He claimed the company is leveraging bridge loans from partners to settle the increased withdrawal requests as a repurchase of the stolen tokens from the open market is unlikely.
Bybit also released a statement to users on X, claiming that it has reported the incident to the proper authorities.
They also claim to have reached out to on-chain providers to track the activities of wallets involved in the heist to prevent the hackers from spending the tokens.
We have reported the case to the appropriate authorities and we will send an update as soon as we have any further information. We have fortunately worked quickly and extensively with on-chain analytics providers to identify and demix the implicated addresses. These actions will…
— Bybit (@Bybit_Official) February 21, 2025
The latest hack adds to a growing list of cyberattacks attributed to the Lazarus Group, which has orchestrated some of the most largest cryptocurrency thefts in history.
Other major incidents from the group include the $625 million Ronin Network (Axie Infinity) heist, the Atomic Wallet breach with a $100 million exodus, the $54 million CoinEx hack and the Alphapo exploit of $60 million.
Information on these pages contains forward-looking statements that involve risks and uncertainties. Markets and instruments profiled on this page are for informational purposes only and should not in any way come across as a recommendation to buy or sell in these assets. You should do your own thorough research before making any investment decisions. FXStreet does not in any way guarantee that this information is free from mistakes, errors, or material misstatements. It also does not guarantee that this information is of a timely nature. Investing in Open Markets involves a great deal of risk, including the loss of all or a portion of your investment, as well as emotional distress. All risks, losses and costs associated with investing, including total loss of principal, are your responsibility. The views and opinions expressed in this article are those of the authors and do not necessarily reflect the official policy or position of FXStreet nor its advertisers. The author will not be held responsible for information that is found at the end of links posted on this page.
If not otherwise explicitly mentioned in the body of the article, at the time of writing, the author has no position in any stock mentioned in this article and no business relationship with any company mentioned. The author has not received compensation for writing this article, other than from FXStreet.
FXStreet and the author do not provide personalized recommendations. The author makes no representations as to the accuracy, completeness, or suitability of this information. FXStreet and the author will not be liable for any errors, omissions or any losses, injuries or damages arising from this information and its display or use. Errors and omissions excepted.
The author and FXStreet are not registered investment advisors and nothing in this article is intended to be investment advice.
Recommended Content
Editors’ Picks

SEC Crypto Task Force plans to establish digital asset regulatory sandbox
The Securities & Exchange Commission's (SEC) Crypto Task Force met with El Salvador's National Commission on Digital Assets (CNAD) representatives to discuss cross-border regulation and a proposed cross-border sandbox project.

DeFi Dev Corp buys additional 65,305 SOL amid broader institutional interest: Solana price slides below $150
Solana (SOL) price faces growing overhead pressure and slides below $150 to trade at $148 at the time of writing on Thursday. The sudden pullback follows the crypto market's edging higher on improving investor sentiment, which saw SOL climb to $154 on Wednesday.

Uniswap Price Forecast: UNI whale moves 9 million tokens to Coinbase Prime
Uniswap (UNI) price hovers around $5.92 at the time of writing on Thursday, having rallied 12.8% so far this week. According to Wu Blockchain, data shows that the address potentially related to the Uniswap team, investor, or advisor transferred 9 million UNI to the Coinbase Prime Deposit on Thursday.

Tron DAO announces $70B USDT supply: Here's how TRX price could react
TRON’s USDT circulation just surpassed $70 billion, signaling rising network utility as TRX price approaches a technically significant breakout. On Wednesday, TRON DAO confirmed that the circulating supply of Tether (USDT) on its blockchain has surpassed $70 billion.

Bitcoin Weekly Forecast: BTC holds steady, Fed warns of tariffs’ impact, as Gold hits new highs
Bitcoin price consolidates above $84,000 on Friday, a short-term support that has gained significance this week. The world's largest cryptocurrency by market capitalization continued to weather storms caused by US President Donald Trump's incessant trade war with China after pausing reciprocal tariffs for 90 days on April 9 for other countries.

The Best brokers to trade EUR/USD
SPONSORED Discover the top brokers for trading EUR/USD in 2025. Our list features brokers with competitive spreads, fast execution, and powerful platforms. Whether you're a beginner or an expert, find the right partner to navigate the dynamic Forex market.