The United States Federal Bureau of Investigation (FBI) has accused North Korea of carrying out an unprecedented cryptocurrency theft worth $1.5 billion, marking the largest cyber heist ever recorded.
In a statement released on Wednesday, the FBI alleged that the cybercriminal group known as TraderTraitor, also identified as the Lazarus Group, orchestrated the attack on Dubai-based cryptocurrency exchange Bybit.
Read more: Bitcoin Drops 6% as Crypto Market Hits Multi-Month Lows
Bybit previously reported a loss of 400,000 Ethereum, which was drained after hackers exploited security vulnerabilities during a transaction. The stolen assets were then transferred to an unknown destination.
“The Democratic People’s Republic of Korea (DPRK) was responsible for stealing approximately $1.5 billion in virtual assets from cryptocurrency exchange Bybit,” the FBI stated in an official advisory.
The agency also noted that the stolen cryptocurrency was swiftly moved across multiple blockchain networks and converted into Bitcoin and other digital currencies. “These assets are expected to be further laundered and eventually exchanged for fiat currency,” the statement added.
Lazarus Group’s History of Cyber Attacks
The Lazarus Group first gained global attention nearly a decade ago for its cyberattack on Sony Pictures, which was carried out in retaliation for The Interview, a film satirizing North Korean leader Kim Jong Un. Since then, the group has been linked to several high-profile cyber heists.
In 2022, the group was allegedly responsible for the $620 million hack of the Ronin Network, which previously held the record for the largest cryptocurrency theft. Additionally, in December 2023, the group was suspected of a cyberattack on Japan-based DMM Bitcoin, stealing over $300 million.
North Korea’s cyber operations can be traced back to at least the mid-1990s. A 2020 report by the U.S. military revealed that the country operates a specialized cyber unit known as Bureau 121, consisting of approximately 6,000 personnel spread across locations in China and Russia.
A United Nations panel investigating North Korea’s sanctions violations estimated last year that Pyongyang had stolen over $3 billion in cryptocurrency since 2017. According to the panel, these funds are primarily used to support North Korea’s nuclear weapons program.
The hacking activities are reportedly overseen by North Korea’s Reconnaissance General Bureau, the country’s top intelligence agency.
Despite facing international sanctions and repeated warnings from Western security agencies, North Korea continues to enhance its cyber capabilities, posing a significant threat to global financial and security infrastructures.
