North Korea Stole $6.75 Billion in Crypto. Nobody Picked a Lock.

Picture a room with a few senior people at a crypto exchange. They need to move some money from a deep-storage safe to a smaller wallet used for daily business. It's routine. They look at the screen, see a normal transfer, and everyone signs.

The screen was lying.

Seconds later, about $1.5 billion in Ether was gone. It was the biggest crypto theft ever recorded, and the group behind it was a government's hacking team.

Here's the short version, in case you're reading this on a bus. One country has taken roughly $6.75 billion from crypto. The scary part isn't the hacking, it's the cleanup afterward, which follows a pattern investigators can actually see. And you don't need a badge to watch some of it happen. A free website will do.

If stories about money, spies and the internet are your thing, hit follow. At the end I'll walk you through looking at a real address yourself, and you can do it in about ten minutes.

The Screen That Lied

The victim here was Bybit, a big exchange based in Dubai. Its savings were stored in what's called a multisig wallet. Think of a bank vault that needs several keys turned at once. Even if one person is tricked, the vault shouldn't open.

The attackers knew that. So they didn't go after the vault. They went after the screen the key-holders used to approve transfers.

The wallet software Bybit used is called Safe{Wallet}. According to Safe's own statement, the attackers compromised a developer's computer there. From that machine they slipped a small piece of malicious code into the website's interface. Security firm Verichains says the code went in on February 19, 2025, and was built to wake up only when Bybit's own signers used it. That happened on February 21.

On the screen, it looked like an ordinary transfer. Underneath, the signers were approving something very different: a change to the wallet's own ownership logic. It's like signing what looks like a utility bill and finding out later you handed over the deed to your house.

Here's the detail I can't stop thinking about. Bybit's vault did exactly what it was designed to do, and the people did exactly what they were supposed to do. Investigators, including firms Bybit hired, traced the root cause to Safe{Wallet}'s infrastructure, not to a break-in at Bybit itself.

Nobody picked a lock. They changed what the lock was attached to.

Who Is Lazarus, Really?

Five days after the theft, on February 26, 2025, the FBI said it plainly: North Korea did it. It labeled the specific operation "TraderTraitor."

You've probably heard the name Lazarus Group. It's best understood as an umbrella label that Western governments use for North Korean hacking crews linked to the country's military intelligence agency, the Reconnaissance General Bureau. TraderTraitor is one of those crews, one known for going after crypto companies and their employees.

This crew isn't new. The same umbrella has been tied to the 2022 Ronin Network theft (about $620 million) and the 2024 theft from Japan's DMM Bitcoin (over $300 million). Years earlier, it was blamed for the Sony Pictures hack.

So why would a government steal crypto? The short answer is sanctions. A country locked out of normal banking has a real reason to want money that doesn't need a bank. Monitoring groups say the cash goes to weapons programs, and one multinational report says the stolen funds in 2024 alone were roughly one-third of North Korea's total foreign currency income that year.

Keep that in mind. This isn't a bored teenager in a hoodie. It's a state project with a budget.

The Scoreboard Nobody Wants to Win

Now the numbers. Different firms count a little differently, so treat all of this as "about."

According to Chainalysis, North Korean hackers stole at least $2.02 billion in 2025. That's a 51% jump from the year before and $681 million more than 2024. Across the whole industry, around $3.4 billion was stolen that year, so North Korea took nearly 60% of everything. Chainalysis also says that's the highest share on record for hacks on crypto services like exchanges, at 76%. Its running total for North Korea now sits around $6.75 billion. That's a lower-bound estimate, so the real number could be higher.

Here's the strange part. Chainalysis says North Korea did this with about 74% fewer known attacks than the year before. Fewer hits, bigger hits.

It's a bit like a burglar who stops robbing houses and robs one bank instead. The biggest hack of 2025 was more than 1,000 times larger than the typical one, and the top three hacks made up 69% of all losses at services.

Which brings us to the big one.

Anatomy of a $1.5 Billion Heist

Roughly 500,000 ETH went out of Bybit's cold wallet in a single go. That one theft equals about 74% of everything North Korea stole in 2025.

Look at how it was built:

1. The way in wasn't Bybit. The attackers went through a third-party tool Bybit trusted. Security people call this a supply chain attack: you don't attack the target, you attack something the target depends on.
2. They did their homework. The malicious code targeted specific wallet owners, which means someone studied exactly who would sign and when.
3. The trick was visual. Signers saw a harmless transaction. What they approved changed the wallet's control.

Chainalysis points out that this is a growing pattern. North Korean crews are also embedding fake IT workers inside crypto firms and posing as recruiters or investors to get at passwords and systems. The common thread is that the weakest link is usually a person or a tool, not the math.

If you hold crypto yourself, take one simple lesson from this: what the screen says and what you're signing can be two different things. Slow down on big approvals, and use more than one check.

The 45-Day Clock

Stealing is only half the job. Stolen crypto is a bit like a bag of marked bills. You can't walk into a store with it, so you need to clean it first.

Here's what gets me about Bybit: the cleanup was fast.

TRM Labs, a blockchain analysis firm, reported that at least $160 million had already been pushed through within 48 hours. By the end of the first week, more than $400 million had moved. TRM said the initial phase was done around March 3, roughly ten days after the theft, with all the stolen ETH moved to new addresses and most of it bridged into Bitcoin.

A few weeks in, Bybit's CEO reported that about 86% of the stolen ETH had been swapped into Bitcoin, around 12,836 BTC, scattered across thousands of wallets. Most of the swapping went through a cross-chain service called THORChain.

And this isn't a one-off. Chainalysis studied North Korean hacks from 2022 to 2025 and found a repeating rhythm, a 45-day cycle in three waves:

• Days 0 to 5: panic mode. Funds are shuffled through DeFi apps and mixers to create distance from the theft.
• Days 6 to 10: the money starts moving toward places that could turn it into cash, like exchanges with light checks and more bridges.
• Days 20 to 45: the long tail. Funds head into no-ID exchanges, Chinese-language "guarantee" marketplaces and other cash-out points.

One more oddity: the hackers send money in small pieces. Chainalysis says over 60% of North Korea's laundered volume moves in chunks under $500,000, while other criminals tend to send much bigger lumps. These guys steal huge but wash small.

This is where investigators get their edge. A routine leaves fingerprints. If you know the clock, you know roughly where to look and when.

Want to see how that looks in the wild? I'll show you at the end.

Mixers Out, Bridges In

Governments haven't ignored this. They've gone after the tools North Korea uses, one at a time.

The U.S. sanctioned the mixer Tornado Cash in 2022 and another mixer, Sinbad, in 2023. A mixer is a service that blends many people's coins together so you can't tell whose is whose. And yet the stolen money kept flowing. (There's a twist: the U.S. removed Tornado Cash from its sanctions list in March 2025 after a court ruling went against the government's approach.)

According to TRM Labs data cited in one analysis, laundering through cross-chain bridges climbed about 66% between 2023 and 2025, while mixer-related activity fell about 37%. Put simply, the money moved from the front door to the side door.

A bridge is a tool that moves your coins from one blockchain to another, like swapping currency at an airport. It's useful for normal people, and it's also a handy way to make a trail harder to follow. Chainalysis found that North Korea leans on bridges and on Chinese-language money-movement services far more than other criminals do. For one cash-out hub called Huione, the difference was about 356%.

Then there's the long game. When one service gets shut down, another pops up. After accusations that it helped wash Bybit's money, the exchange eXch announced in April 2025 that it would close.

2026: The Streak Nobody Stopped

If you thought that was a one-time storm, 2026 says otherwise.

TRM Labs says North Korea-linked hackers took about $577 million in just two attacks in April, which was 76% of all crypto hack losses through that month:

• Drift Protocol, April 1, about $285 million. TRM described months of social engineering, including in-person meetings between North Korean proxies and people at the company. It called that potentially unprecedented. The theft itself used a feature on the Solana blockchain that lets pre-signed transactions sit and be used later.
• KelpDAO, April 18, about $292 million. TRM tied it to a design weakness in a cross-chain bridge that depended on a single verifier. Around $75 million was frozen, and the rest moved quickly through THORChain.

Those two attacks were about 3% of the incidents TRM counted that period, but the vast majority of the money. Later, TRM reported that North Korea's share for the first half of 2026 came to about 66%.

Then came Bitget on September 24, 2026. Hackers drained roughly $387.5 million from its hot and warm wallets. Bitget's CEO said the pattern looked like earlier North Korean work, and the analytics firm Elliptic called a North Korean link "highly likely." Be careful here, though. Attribution isn't confirmed, and the CEO later softened her early claim. Bitget says its user protection fund, valued at over $464 million, covers the loss. Elliptic says this theft pushed suspected North Korean heists past $1 billion for 2026.

Notice the pattern. Different victims, different tricks, same playbook: patience up front, speed afterward.

The Internet Detectives

Here's the hopeful part. Because blockchains are public, regular people can catch some of this.

One name comes up again and again: ZachXBT, an anonymous on-chain investigator. On October 5, 2026, he posted a long thread claiming he'd spent months posing as a paying customer to get inside a Chinese money-laundering network. He says it moved over $1 billion in stolen crypto for Lazarus across several hacks, and that one of its operators told him the team had washed most of the Bybit money. He says he fronted about $349,700 of his own money to build trust, and that the information helped freeze funds, including 442,000 USDT frozen by Tether.

I want to be careful. This is alleged. Coverage of the thread points out it's his account of private chats plus on-chain matches, not a law enforcement finding. But the method is the interesting part: public support requests, timing patterns between chains, and patient trust-building.

Meanwhile, the T3 Financial Crime Unit, a joint effort by Tether, TRON and TRM Labs, announced it froze around $9 million tied to the Bybit hack. It's small compared to $1.5 billion, but it shows the point of all this tracing: once you can see where money goes, someone can sometimes press the brakes.

Why Sanctions Keep Missing

If governments know all this, why isn't it working better?

First, the cleanup business is made of lots of small operators, not one big company. Chainalysis describes North Korea's Chinese-language laundering as a network of many different operators, some with weak compliance. Shut one down and the others keep going.

Second, the U.S. has hit the plumbing repeatedly. It went after Tornado Cash and Sinbad. It also moved against Huione Group, with a Treasury rule that took effect in November 2025 cutting it off from U.S. banks and calling it a hub for laundering North Korean cyber heists. But the stolen money has found new routes after each round.

Third, the people problem. A multinational monitoring team (made up of 11 countries) reported in 2025 that North Korean IT workers were active in at least eight countries and earning hundreds of millions of dollars, despite UN bans. That's the human side of the same machine: workers get access, hackers use it, and launderers clean the proceeds.

Sanctions aren't useless. They raise the cost and slow things down. But right now, the machine adapts faster than the paperwork.

Your Turn: Follow One Wallet

Okay, this is the fun part. You don't need special software. You need a browser and ten minutes.

1. Open the FBI's public alert about the Bybit hack (link in the references below) and copy the Ethereum address it lists as connected to the theft.
2. Go to etherscan.io and paste that address into the search bar.
3. Open the Transactions tab. Look at the dates. When did it go quiet?
4. Check Internal Transactions and Token Transfers. Where did the money go?
5. Click one of the receiving addresses and repeat. Look for labels or name tags Etherscan has attached.
6. Write down three things: when it was last active, where it sent funds, and whether any label is attached.

A few ground rules. View only. Never send anything to an address you're investigating, and never trust addresses someone drops in a Telegram chat. A public address is also not a person. Explorers show money moving, not names, and TRM has warned that investigators can chase false leads when unrelated funds come out of mixers.

This article is for education only. It isn't financial or legal advice.

References (10 links)

1. Chainalysis, "North Korea Drives Record $2 Billion Crypto Theft Year": http://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2026/
2. FBI IC3, "North Korea Responsible for $1.5 Billion Bybit Hack": http://ic3.gov/PSA/2025/PSA250226
3. TRM Labs, "Bybit Hack Update: North Korea Moves to Next Stage of Laundering": http://www.trmlabs.com/post/bybit-hack-update-north-korea-moves-to-next-stage-of-laundering
4. TRM Labs, "North Korea Stole 76% of All Crypto Hack Value in 2026": http://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks
5. The Hacker News, "Bybit Hack Traced to Safe{Wallet} Supply Chain Attack": http://thehackernews.com/2025/02/bybit-hack-traced-to-safewallet-supply.html
6. Decrypt, "Bybit CEO: Two-Thirds of Funds Still Traceable": http://decrypt.co/315593/bybit-ceo-two-thirds-of-funds-from-lazarus-group-hack-still-traceable
7. FinCEN, "Final Rule Severing Huione Group from the U.S. Financial System": http://www.fincen.gov/news/news-releases/fincen-issues-final-rule-severing-huione-group-us-financial-system
8. The Block, "ZachXBT Infiltrated Chinese Launderers": http://www.theblock.co/news/defi/2026-10-06-zachxbt-infiltrated-chinese-launderers-lazarus-hack-417767
9. Decrypt, "North Korea Has Stolen Billions in Crypto" (MSMT report): http://decrypt.co/346010
10. Gizmodo, "North Korea 'Very Likely' Behind $388 Million Bitget Hack": http://gizmodo.com/north-korea-very-likely-behind-388-million-hack-of-crypto-exchange-bitget-2000817421