Johannesburg – By any measure, it was one of the most audacious thefts in modern financial history.
On 21 February 2025, cryptocurrency exchange Bybit revealed that hackers had stolen approximately $1.5 billion worth of digital assets in what investigators described as the largest cryptocurrency theft ever recorded.
The scale of the robbery eclipsed previous crypto heists and rivalled some of the biggest bank robberies and financial thefts in history. [cnbc.com], [fbi.gov]
Unlike traditional bank robbers armed with guns and getaway cars, the perpetrators never entered a building.
They operated from behind computer screens, using sophisticated cyber techniques to trick authorised employees into approving a fraudulent transaction.
What happened?
Bybit, one of the world’s largest cryptocurrency exchanges, stored a substantial amount of customer assets in so-called “cold wallets” – digital wallets kept offline and considered among the safest methods of storing cryptocurrency. [cnbc.com]
The theft occurred during what appeared to be a routine transfer of cryptocurrency from a cold wallet to a “warm” or operational wallet used for day-to-day trading activities.
According to investigators, the hackers manipulated the transaction approval process so that Bybit executives believed they were authorising a legitimate transfer when, in reality, they were approving a transfer of funds to addresses controlled by the attackers. [cloudskope.com], [itokenly.com]
Within minutes, roughly 401 000 Ether, the cryptocurrency of the Ethereum blockchain, was moved into wallets controlled by the criminals.
The assets were then rapidly dispersed across numerous accounts and converted into other forms of cryptocurrency to make tracking and recovery more difficult. [blockready.com], [cnbc.com]
How was the hack carried out?
Investigators concluded that the attack was not a direct breach of the Ethereum blockchain itself.
Instead, it exploited weaknesses in software and human trust.
According to security analyses, the attackers compromised infrastructure associated with Safe{Wallet}, a third-party multi-signature wallet platform used by Bybit.
Malicious code was allegedly inserted into the wallet-signing interface, causing authorised users to see a legitimate transaction while actually approving a completely different one. [cloudskope.com], [itokenly.com]
In effect, the hackers altered what decision-makers saw on their screens.
Bybit’s signatories approved the transaction believing it was routine, unaware that the funds were being redirected.
Once the required signatures were collected, the transfer was executed and the cryptocurrency disappeared into attacker-controlled wallets. [cloudskope.com], [blockready.com]
Cybersecurity specialists described the operation as a sophisticated supply-chain attack combined with social engineering.
Rather than attacking the exchange directly, the criminals targeted trusted systems and people connected to it. [sygnia.co], [d3cconsulting.com]
Who stole the money?
The United States Federal Bureau of Investigation attributed the theft to North Korean cyber actors known as “TraderTraitor”, a group linked to the notorious Lazarus Group.
The FBI announced on 26 February 2025 that North Korea was responsible for stealing approximately $1.5 billion in virtual assets from Bybit. [fbi.gov], [ic3.gov]
Lazarus has long been accused of conducting cyber attacks against banks, cryptocurrency platforms, and financial institutions worldwide.
The group is believed to operate under North Korea’s intelligence apparatus and has allegedly stolen billions of dollars worth of digital assets over the past decade. [cnbc.com], [sygnia.co]
Authorities say the group typically uses social-engineering tactics, phishing attacks and malware to gain access to systems.
Once inside, members carefully study procedures and exploit weaknesses to authorise fraudulent transactions. [financefeeds.com], [freepressjournal.in]
Why cryptocurrency is attractive to criminals
Cryptocurrency is a form of digital money that exists on decentralised computer networks known as blockchains.
Unlike traditional currencies such as the rand, dollar or pound, cryptocurrencies are not issued by central banks.
Instead, ownership is recorded on a public digital ledger that can be viewed by anyone.
Bitcoin, Ethereum and Solana are among the best-known cryptocurrencies.
Users hold cryptocurrency in digital wallets, which allow them to send and receive funds anywhere in the world without requiring a bank.
Transactions can often be completed within minutes.
For cybercriminals, cryptocurrency offers several advantages.
Funds can be moved rapidly across borders, converted into different cryptocurrencies, and dispersed among thousands of wallet addresses.
While blockchain transactions are public and traceable, criminals often employ mixers, decentralised exchanges and cross-chain conversions to obscure the money trail. [fbi.gov], [blockready.com]
Can cryptocurrency be used to buy things?
Yes. Cryptocurrency can be redeemed or spent in several ways.
Many users exchange it for traditional money such as dollars or rand through cryptocurrency exchanges.
Once converted, the proceeds can be transferred into bank accounts and spent like ordinary cash.
Some retailers and online merchants also accept cryptocurrency directly as payment.
Customers can use digital wallets to purchase products, services, airline tickets, software subscriptions, and even property in certain markets.
Another common method involves crypto debit cards.
These cards automatically convert cryptocurrency into traditional currency at the point of sale, allowing users to pay at ordinary shops and restaurants without the merchant needing to handle cryptocurrency directly.
A warning for the digital age
The Bybit theft demonstrated how vulnerable even sophisticated financial platforms can be to determined cybercriminals.
It also highlighted the growing geopolitical dimension of cryptocurrency theft, with governments increasingly accusing state-backed groups of using cybercrime to generate revenue.
Although many of the stolen assets were tracked and some were frozen by industry partners and investigators, the attack remains a stark reminder that in the digital era, the world’s biggest robberies may no longer involve vaults, masks or guns.
Instead, they can unfold with a few clicks of a mouse and billions of dollars can vanish in minutes. [bybit.com], [fbi.gov]
Disclaimer: This article was compiled using the AI tool Microsoft Copilot and may contain inaccuracies
