Estimated reading time: 6 minutes
Introduction
The Lazarus Group, a notorious hacking collective linked to North Korea, has undergone a remarkable transformation since its inception around 2009. What began as a group orchestrating basic cyberattacks has evolved into one of the most sophisticated threats in the digital world, with their latest exploit—the $1.5 billion Bybit hack on February 21, 2025—marking the largest cryptocurrency theft in history. This blog traces their journey from state-sponsored espionage to their current focus on crypto heists, exploring how their tactics have adapted and what this means for the future of cybersecurity.
Early Days: Espionage and Disruption
The Lazarus Group’s origins lie in relatively simple cyberattacks aimed at disruption and intelligence gathering, primarily targeting South Korea. Their earliest known operations, such as Operation Troy (2009-2011) and Ten Days of Rain (2011), involved distributed denial-of-service (DDoS) attacks that overwhelmed government and media websites. By 2013, the DarkSeoul attack showcased their growing capabilities, using wiper malware to erase data from South Korean banks and broadcasters.
Their international breakthrough came in 2014 with the Sony Pictures hack. In retaliation to the film The Interview, which mocked North Korean leader Kim Jong-un, the group leaked unreleased movies, employee data, and internal emails, costing Sony millions. This attack marked their shift toward high-profile targets and demonstrated their ability to blend espionage with financial and reputational damage.
Turning to Financial Gain
By 2016, the Lazarus Group pivoted to financial theft, reflecting North Korea’s need to fund its regime amid international sanctions. The Bangladesh Bank heist stands out: hackers used fraudulent SWIFT instructions to steal $101 million from the bank’s Federal Reserve account in New York. Though they aimed for $1 billion, errors limited their haul—yet it showcased their ability to infiltrate global financial systems.
The 2017 WannaCry ransomware attack further highlighted their evolution. Exploiting an NSA-leaked vulnerability (EternalBlue), they infected 200,000 computers worldwide, demanding Bitcoin ransoms that netted $160,000. While the payout was modest, the attack’s scale—disrupting hospitals, businesses, and governments—underscored their growing technical prowess and willingness to target civilians.
The Crypto Era Begins
Cryptocurrency, with its decentralized nature and lax regulation, became the perfect target for the Lazarus Group by the late 2010s. Their first major crypto heist hit Bithumb in 2017, stealing $7 million from the South Korean exchange. Later that year, they drove Youbit to bankruptcy by siphoning 17% of its assets. These early successes set the stage for bigger scores.
In 2022, the group executed the $620 million Axie Infinity Ronin Network hack, targeting a blockchain gaming platform. Using social engineering to compromise private keys, they drained funds via the Ethereum blockchain, laundering them through mixers like Tornado Cash. That same year, they stole $100 million from Harmony’s Horizon Bridge, exploiting vulnerabilities in cross-chain protocols. These attacks established a pattern: sophisticated phishing, smart contract manipulation, and rapid laundering.
The Bybit Hack: A New Peak
On February 21, 2025, the Lazarus Group struck again, this time targeting Bybit, a Dubai-based crypto exchange managing $20 billion in assets. The breach saw $1.5 billion in Ethereum and related tokens vanish from an offline wallet—a cold storage system meant to be impervious to hacks. How did they do it? A deceptive transaction tricked wallet signers into approving a malicious smart contract change, masked as a legitimate transfer.
Blockchain sleuth ZachXBT traced the attack to Lazarus, citing test transactions and wallet patterns matching their past exploits. Arkham Intelligence corroborated this, linking it to a January 2025 Phemex hack ($70 million). Bybit’s CEO, Ben Zhou, confirmed the loss but insisted the exchange remained solvent, stating on X, “All client assets are 1:1 backed; we can cover the loss.” Still, the hack sent shockwaves through the market, with Ether and Bitcoin prices dipping amid fears of further fallout.
Why Crypto? Why Now?
The Lazarus Group’s shift to cryptocurrency reflects both opportunity and necessity. Crypto’s pseudonymous nature and lack of centralized oversight make it a goldmine for state actors like North Korea, which uses these funds to bypass sanctions and finance its missile programs. The Bybit hack’s $1.5 billion haul dwarfs their earlier efforts, surpassing the $620 million Ronin Network record and highlighting the escalating stakes.
Their methods have evolved too. Early DDoS attacks required minimal skill, but recent heists involve advanced social engineering, malware, and blockchain forensics evasion. Researchers note their use of custom tools—like AppleJeus malware—and laundering via decentralized exchanges, showing a group that learns and adapts.
Impact and Implications
The Bybit hack’s scale—50% larger than the previous record—has rattled the crypto industry. It exposed vulnerabilities in cold wallets, long considered secure, and sparked volatility as traders speculated on Bybit’s recovery moves. Beyond finance, it’s a geopolitical signal: North Korea’s cyber army remains a potent threat, blending crime with statecraft.
For the crypto world, this is a wake-up call. Exchanges need multi-signature wallets, real-time monitoring, and better employee training to counter phishing. International cooperation—between firms, blockchain analysts like ZachXBT, and law enforcement—is crucial, yet complicated by Lazarus’s state backing. Regulation, too, looms larger; without it, crypto remains a hacker’s playground.
Table: Notable Lazarus Group Crypto Hacks
|
Year
|
Target
|
Amount Stolen (USD)
|
Details
|
|---|---|---|---|
|
2017
|
Bithumb
|
7M
|
Stolen funds from South Korean exchange.
|
|
2017
|
Youbit
|
–
|
Led to bankruptcy after losing 17% of assets.
|
|
2022
|
Axie Infinity Ronin Network
|
620M
|
One of the largest crypto heists at the time, targeting gamers globally.
|
|
2022
|
Horizon Bridge
|
100M
|
Stolen virtual currency from Harmony’s bridge.
|
|
2023
|
Atomic Wallet
|
100M
|
Stolen from users globally.
|
|
2023
|
Stake.com
|
41M
|
Online casino and betting platform breach.
|
|
2024
|
WazirX
|
234.9M
|
Indian exchange hack, significant asset loss.
|
|
2025
|
Bybit
|
1,500M
|
Largest crypto theft, offline Ethereum wallet compromised.
|
Looking Ahead
The Lazarus Group’s evolution from state secrets to crypto wallets mirrors the digital age’s shifting battlegrounds. From Sony’s servers to Bybit’s blockchain, they’ve exploited each era’s weaknesses with chilling precision. As cryptocurrency grows, so will their ambitions—unless the industry and governments act decisively.
This isn’t just a story of theft; it’s a saga of adaptation, ambition, and the blurred lines between cybercrime and warfare. The Bybit hack may be their boldest move yet, but history suggests it won’t be their last.
Haris Jan has been blogging about frontier technologies since 2019, offering insights on biotechnology, AI, blockchain, and quantum computing while focusing on their practical business applications. His writings combine technical expertise with strategic analysis to help readers understand both the fundamentals and implications of emerging technologies.
