The operators of the Bybit exchange did what is considered a model of security: they kept the main funds in a cold wallet and made scheduled transfers of a portion to a hot one. They saw the recipient address on the screen with their own eyes and confirmed the transfer. And the money went somewhere else entirely. In February 2025, Lazarus made off with about $1.5 billion — the largest hack in the history of cryptocurrency — without breaking a single key, but by substituting what people saw on the screen. This case changes the very notion of where the boundary of security lies.
▶ Video case study: Bybit 2025 (English narration).
Around 21 February 2025, roughly $1.5 billion was stolen from Bybit. The FBI attributed the attack to the Lazarus group (also known under the names TraderTraitor and APT38) — the very same North Korean cyber group behind the Ronin hack. But whereas Ronin was an attack on a bridge, here the vector turned out to be fundamentally different and far more insidious.
The hack was not a "hack" in the usual sense: the attackers did not crack the cold wallet's private keys and did not break the cryptography. They attacked what sits between the human and the blockchain — the interface.
Bybit used Safe{Wallet} (a multisignature wallet) to manage funds. The attackers injected malicious JavaScript into the user interface of this wallet — a frontend hosted in AWS S3 cloud storage. This is a classic supply-chain attack: what was compromised was not the wallet itself or the exchange directly, but the code that draws the interface for the signers.
What follows is the most insidious part. When the Bybit operators carried out a scheduled transfer from the cold wallet to the hot one, the malicious script substituted the transaction data. On the screen the signers saw a legitimate, expected operation — and dutifully confirmed it. But what was actually being signed was an entirely different transaction, sending the funds to the attackers' addresses. People signed, with their real keys, something other than what they thought.
The keys were not stolen. What was substituted was the reality that those keys were signing.
— the essence of the Bybit attack (paraphrase to explain the mechanism)
Whereas in the Bitfinex case the thieves were afraid to touch the loot for six years, Lazarus in 2025 acted the exact opposite way — at maximum speed. The group understood: as soon as the industry recognized the stolen funds and began blocking addresses, the laundering window would close. So the money was set in motion almost instantly.
The response to Lazarus's speed was the industry's speed. The FBI promptly published a list of 51 Ethereum addresses linked to the theft, so that exchanges, mixer detectors, and AML services could immediately add them to their blacklists and freeze any incoming funds. This is the modern model of defense: not just the state but the entire ecosystem acts as a distributed blocking network. The faster addresses become known, the fewer "clean" exits remain for the launderer.
For us, the screening specialists, this illustrates the meaning of dynamic sanctions and "hacker" lists. Such lists are updated literally on the heels of events, and an AML system is obliged to pull them in promptly — otherwise it will let through money that the rest of the market has already recognized as stolen.
Comparing two cases of the same group, we see how the adversary evolves.
In the last three cases one laundering tool kept surfacing — the Tornado Cash mixer. In the next and concluding case study of the section we will look at it separately: how and why U.S. sanctions were, for the first time, imposed not on a person or a company but on lines of program code.
The facts are presented from open sources. The materials are for educational purposes.