North Korean hackers steal record $1.5 billion in single crypto hack, security firm says

2025-02-25 01:52:00

Abstract: N. Korean hackers stole $1.5B in crypto from Bybit, funding weapons programs. $160M laundered quickly. Int'l cooperation is crucial.

Security experts revealed to CNN that North Korean hackers stole $1.5 billion (approximately A$2.3 billion) worth of cryptocurrency in a single heist, making it the largest cryptocurrency theft ever recorded. This incident highlights the severity of North Korean cybercrime activities and the threat they pose to global financial security. The scale of these operations demonstrates a sophisticated level of planning and execution.

The target of the hack was Bybit, a company that claims to be the world's second-largest cryptocurrency exchange with over 40 million users. According to cryptocurrency tracking firm TRM Labs, the hackers stole an amount equivalent to a significant portion of North Korea's annual gross domestic product in just a few minutes on Friday. Over the weekend, the hackers had already laundered approximately $160 million of the stolen funds through a series of accounts linked to North Korean agents. This rapid laundering process makes tracking and recovering the funds extremely challenging.

TRM Labs stated that through this single hack, the amount of cryptocurrency stolen by North Koreans is almost double that of last year. This represents an early test for the Trump administration on how to address the daunting challenge of preventing North Korea from funding its nuclear weapons and missile programs through hacking activities. Nick Carlsen, a former FBI intelligence analyst now working at TRM Labs, stated, "We've never seen an event of this scale before. The ability of these illicit financial networks to absorb such a massive amount of funds so quickly is deeply concerning." The international community must collaborate to address this growing threat.

According to current and former U.S. and South Korean officials, North Korea's powerful hacking teams are a significant source of revenue for the nuclear-armed, sanctioned dictatorship. Reports from the United Nations and private companies show that North Korean hackers have stolen billions of dollars from banks and cryptocurrency companies in recent years. A White House official stated in 2023 that approximately half of North Korea's missile program is funded by such digital thefts. This reliance on cybercrime underscores the regime's desperation for funding.

Bybit CEO Ben Zhou stated that the company is solvent and can cover the $1.5 billion loss. The company said in a statement: "Bybit is working closely with regulators and law enforcement to address this hacking incident." An FBI spokesperson stated that the bureau had no comment on the Bybit theft. CNN has requested comment from the North Korean embassy in London. The cooperation between Bybit and law enforcement agencies is crucial for the investigation.

Once a large cryptocurrency theft occurs, North Korean agents must transfer the money back to Pyongyang. The laundering process typically involves a series of exchanges through different types of digital currencies, eventually converting them into U.S. dollars or Chinese yuan. U.S. and South Korean law enforcement officials monitoring the laundering process often have only minutes to swoop in and seize a portion of the stolen funds. CNN previously reported on one such operation, recovering $1 million from $100 million that North Koreans allegedly stole from a California-based cryptocurrency company. The speed and complexity of these transactions pose significant challenges to law enforcement.

Investigators are currently trying to intercept a portion of the $1.5 billion stolen from Bybit. A group of cryptocurrency security experts said they have so far helped recover about $43 million of the stolen funds. Tom Robinson, co-founder of another cryptocurrency tracking company, Elliptic, said that another $243,000 of the stolen funds had been seized: "A drop in the ocean, but it's a start." Bybit said it would give 10% of any recovered funds to security experts who played a role in recovering the stolen funds. These efforts highlight the ongoing battle against cybercriminals.

Former FBI analyst Carlsen stated that the U.S. and other countries need to be more proactive in trying to intercept cryptocurrency stolen by North Koreans. Carlsen said: "The current strategy of the government and industry is clearly not working. People should now re-examine how to deter and punish these North Korean hacking activities." A more comprehensive and coordinated international approach is needed to effectively combat these illicit activities.