The Lazarus hacking group, led by Pak Jin Hyok (wanted by the FBI), executed the largest cryptocurrency hack in history. They stole $1.46 billion in ETH and ERC-20 tokens from the Bybit exchange, which is twice the previous record.
How did they manage this? Let's break it down. 🧵👇
🔥 Who are Lazarus?
This is a North Korean hacking group linked to the DPRK's military program. They were behind the largest attacks in history:
• Axie Infinity (Ronin Bridge) — $625M
• Harmony Bridge — $100M
• Atomic Wallet — $100M
• Stake — $41M
• Alphapo Hot Wallet — $60M+
• WazirX — $230M
The total amount of their cybercrimes exceeds $3 billion.
🚨 How did the Bybit hack happen?
1️⃣ Lazarus conducted a social engineering campaign using a fake Safe Wallet interface.
2️⃣ Signatories saw the correct addresses and links, but hidden code altered the logic of the smart contract, giving hackers full control.
3️⃣ This allowed them to bypass cryptographic protections and quietly withdraw $1.46 billion.
💡 After the attack, Lazarus became the largest ETH bull, owning 0.42% of all $ETH.
💻 How do North Korean hackers operate?
🔸 State support — they fund military and nuclear programs of the DPRK.
🔸 Long-term planning — they infiltrate companies, posing as HR or business partners.
🔸 Advanced techniques — they use malware, phishing, and DeFi loopholes to cover their tracks.
🔄 How do they launder stolen crypto?
After the hack, they use DeFi platforms without KYC/AML, making transactions untraceable.
📌 Example: After the KuCoin hack ($275M), they used Uniswap to 'clean' the funds.
⏳ Why don't they sell immediately?
Lazarus is known for the 'Diamond Hands' tactic – they hold stolen assets for years, waiting for a better moment to cash out.
✔ Money from previous hacks is still untouched.
✔ When they sell, they use crypto mixers.
🚀 Why is this important for the ETH market?
🔹 Bybit will not return the stolen ETH – the exchange covers withdrawals with borrowed funds.
🔹 Lazarus cannot quickly cash out ETH, creating a shortage.
🔹 This increases buying pressure, but the market could still crash.
📢 Conclusion: Lazarus has shown that cryptocurrency exchanges remain the primary target for hackers. Each new attack is not just a cybercrime but part of a state-sponsored cyberwar.
#lazurit #safeWallet #bybit #DiamondHandsOrForgetfulHands #Ethficoim