Bybit, DeFi, and the Lazarus Playbook: North Korea’s $1.4B Crypto Heist Exposed

North Korea has become a formidable force in the world of cybercrime, with a significant rise in crypto hacks that have alarmed governments and cybersecurity experts around the globe.

Contents

The country’s state-backed hacker groups, such as the Lazarus Group, have targeted cryptocurrency exchanges, decentralized finance (DeFi) platforms, and individual crypto developers in a series of high-profile crypto hacks. The scale and sophistication of these attacks have raised serious concerns about the security of the global cryptocurrency ecosystem.

North Korea’s Crypto Heists

North Korea’s crypto hacks have reached alarming levels, with hackers linked to the regime stealing billions of dollars in cryptocurrencies. In February 2024, the Lazarus Group carried out the largest-ever crypto hack on Bybit, a major crypto exchange, stealing $1.4 billion. This crypto hack stands as a grim record for the industry.

The stolen crypto funds have fueled North Korea’s weapons development programs, providing a way to bypass international sanctions. These developments have prompted increased discussions among global leaders, with the issue likely to be a key topic at the upcoming G7 summit in Canada.

The rise in crypto hacks attributed to North Korea is not isolated to the Bybit incident. According to Chainalysis, in 2024 alone, North Korean hackers conducted 47 separate crypto hacks, stealing over $1.3 billion.

These crypto hacks are not only affecting exchanges but also individuals and businesses involved in the crypto space. Blockchain analytics firms are scrambling to track the stolen assets as they are laundered through crypto mixers and peer-to-peer exchanges, making it difficult for authorities to trace the funds.

Crypto Hacks report — Source: Chainalysis

North Korean Hacking Groups: The Lazarus Group

The Lazarus Group has become synonymous with North Korea’s cyberattacks. This group is responsible for numerous crypto hacks, including the 2024 Bybit hack. Lazarus’s sophisticated use of malware, social engineering, and targeted phishing attacks has made it one of the most dangerous hacker organizations in the world. Lazarus doesn’t just rely on one method to conduct crypto hacks; they employ a diverse range of strategies to exploit vulnerabilities in the crypto ecosystem.

In April 2024, Lazarus operatives set up three shell companies to distribute malware to unsuspecting crypto developers. These companies, two of which were registered in the United States, aimed to compromise systems and steal sensitive information, further demonstrating the group’s far-reaching influence. The use of shell companies as part of their crypto hack strategy has raised alarms in the cybersecurity community.

Insider Threats in Crypto Firms

North Korea’s cyber strategy also includes infiltrating crypto companies by exploiting insider threats. As crypto firms continue to grow, so does the risk of North Korean IT workers securing positions within these companies to steal valuable information. Both South Korea and the United States have issued warnings about North Korean workers infiltrating crypto firms. These workers provide insider access that can lead to severe financial losses through crypto hacks.

For example, crypto exchange Kraken thwarted an insider crypto hack attempt when a suspected North Korean hacker tried to infiltrate its systems. Kraken’s chief security officer, Nick Percoco, exposed the deception through trap identity verification tests. This incident highlights the lengths to which North Korean hackers will go to carry out their crypto hacks.

The Impact of Crypto Hacks on Global Finance

The impact of these crypto hacks goes beyond the crypto industry itself. North Korea has used the stolen funds to circumvent global sanctions and fund its military programs, including weapons development.

As digital assets become more embedded in the global financial system, North Korea’s crypto hacks have broader geopolitical implications. The funds stolen from crypto exchanges are increasingly being funneled through complex laundering schemes, making it more difficult for authorities to trace and recover them.

Global Response to North Korean Crypto Hacks

Countries like the United States, South Korea, and Japan have ramped up efforts to curb the impact of North Korea’s crypto hacks. Sanctions have been imposed on entities and individuals involved in laundering stolen crypto funds.

The U.S. Treasury has even proposed barring Cambodia’s Huione Group from the U.S. financial system for allegedly assisting in the laundering process. Despite these efforts, North Korean hackers continue to evolve their methods, and crypto hacks remain rampant.

The Growing Threat of Crypto Hacks

In 2024, North Korea’s crypto hacks accounted for 61% of all cryptocurrency thefts globally, according to Chainalysis. The total stolen amount reached a staggering $1.34 billion. As hackers grow more sophisticated, the tools used in these crypto hacks are becoming harder to detect. The use of decentralized finance protocols, blockchain bridges, and crypto mixers complicates the task of tracing the stolen funds.

Conclusion

North Korea’s continued involvement in crypto hacks is a growing global concern. With billions of dollars stolen in a series of highly sophisticated attacks, the country has emerged as one of the most significant threats to the global cryptocurrency industry.

As crypto hacks become more complex, the challenge of securing digital assets and preventing financial crime grows. The international community, led by the G7, must unite in addressing these cyber threats to protect the integrity of the global financial system.