Bybit $1.5B Hack: How AI Forensics Traced the Lazarus Group
A forensic breakdown of the largest exchange hack in cryptocurrency history — from the Safe multisig compromise to THORChain laundering and FBI attribution.
Key Facts
- Date: February 21, 2025
- Amount Stolen: $1.5 billion in ETH and ERC-20 tokens
- Attribution: Lazarus Group (DPRK) — FBI confirmed
- Attack Vector: Safe multisig contract compromise
- Status: Ongoing investigation; funds actively being laundered
What Happened
On February 21, 2025, attackers compromised Bybit's Safe (formerly Gnosis Safe) multisig wallet contract, draining approximately $1.5 billion in ETH and ERC-20 tokens. The exploit did not rely on a smart contract vulnerability in the traditional sense — instead, the attackers manipulated the multisig signing process itself, likely through a supply-chain compromise of the Safe UI or a targeted social engineering operation against key signers.
Within hours, the FBI publicly attributed the attack to North Korea's Lazarus Group, marking it as the single largest cryptocurrency exchange hack in history — surpassing the 2022 Ronin Bridge exploit ($625M) by more than double.
The Laundering Trail
ForensicBlock's AI agents began tracing the stolen funds within minutes of the exploit. The attacker's primary address, 0x47666fab8bd0ac7003bce3f5c3585383f09486e2, immediately began splitting and routing funds through a multi-layered obfuscation strategy:
Observed Laundering Phases:
- 1.Fragmentation — Stolen ETH split across 50+ intermediary wallets within the first 2 hours. Each wallet received between 200–5,000 ETH.
- 2.Cross-Chain Bridging via THORChain — Significant volumes swapped from ETH to BTC using THORChain's permissionless liquidity pools. THORChain's lack of KYC requirements made it the primary laundering conduit.
- 3.Mixer Rotation — BTC proceeds routed through multiple mixing services, including services that replaced the now-sanctioned Sinbad mixer.
- 4.Exchange Deposits — Small amounts deposited into exchanges across multiple jurisdictions, consistent with Lazarus Group's documented cashout patterns.
How AI Agents Investigated
ForensicBlock deployed its full 9-agent protocol on the Bybit attacker address. Here is how each agent contributed to the investigation:
Mapped the fund flow graph across 50+ wallets and 3 chains, identifying THORChain as the primary bridge.
Flagged the attacker address as CRITICAL (100/100) within seconds based on OFAC sanctions data and Lazarus Group pattern matching.
Classified the attack as a multisig compromise with state-sponsored attribution, generating a 17-category risk profile.
Identified 4 exchange deposit addresses and generated freeze request templates for Binance, OKX, and Huobi.
Set up real-time monitoring on all intermediary wallets, alerting on every subsequent fund movement.
Generated a court-ready PDF with SHA-256 verification, chain of custody documentation, and Daubert-compliant methodology.
The Lazarus Group Pattern
The Bybit hack fits a well-documented pattern of DPRK-affiliated cryptocurrency theft. The United Nations Security Council Report S/2024/215 documented that North Korea's cyber operations stole an estimated $3.5 billion in cryptocurrency between 2017 and 2024. The Bybit attack added $1.5B to that total in a single operation.
Key behavioral signatures that ForensicBlock's AI identified as consistent with Lazarus Group operations:
- →Immediate fragmentation into dozens of intermediary wallets (no cooling-off period)
- →Heavy reliance on decentralized cross-chain bridges (THORChain, previously Ren Bridge)
- →ETH-to-BTC conversion before mixer entry — identical to Harmony Bridge and Ronin patterns
- →Low-value exchange deposits distributed across Asian and Eastern European exchanges
- →Patient cashout timeline — Lazarus operations typically take 12–18 months to fully liquidate
Lessons for Investigators
- Multisig security is only as strong as the signing interface. The Bybit exploit targeted the human layer, not the contract code. Organizations using multisig wallets must audit the entire signing stack, including UI dependencies.
- Cross-chain bridges are the new mixers. THORChain processed hundreds of millions in stolen ETH because it operates without KYC. Investigators must monitor bridge activity in real-time, not retroactively.
- Speed matters. The first 24 hours after an exploit are critical. AI-powered investigation tools can begin tracing funds immediately while human analysts coordinate exchange freezes.
- State-sponsored actors are patient. Lazarus Group cashout operations span months to years. Long-term monitoring with automated alerts — not one-time investigations — is required.
Investigate This Case Yourself
Paste the attacker's seed address into ForensicBlock and let 6 AI agents trace the funds across chains, through mixers, and into exchange deposit wallets — with a court-grade evidence package at the end.
References
- FBI Public Statement on DPRK Cryptocurrency Theft, February 2025
- UN Security Council Report S/2024/215 — DPRK Cyber Operations
- OFAC Sanctions List — Lazarus Group Designated Addresses
- Bybit Official Incident Report, February 2025