North Korean hackers have washed more than $1 billion stolen from Bibit in less than six months

Table of Contents

The biggest security breaches of 2025 caused $1.5 billion to be stolen from Crypto Exchange Bybit, fueling one of the fastest laundry campaigns the coalition has ever seen, as mentioned in a joint announcement by the coalition led by incident response group Zeroshadow.

The laundry campaign, linked to Tradertraitor, a subgroup of the Lazarus Group, successfully bypassed the crypto community’s defenses, including wallet blacklisting, tracing tools and prize programs, within six months.

Blockchain security experts say that the stolen funds are “mainly being moved to the hands of Chinese moneylanders” almost immediately, adding that washing machines will split the funds into small transactions and use decentralized services to avoid detection.

“They don’t move large amounts of funds at once and split the transaction into $30,000 each so that the freeze doesn’t have an undue impact. In fact, out of the 11,633 wallets used to wash funds from Bibit Hacks, only 5% of the wallets over $1 million were holding more than $1 million.

Global risks

Experts highlighted the persistent challenges of halting crypto theft, including slow responses to law enforcement warnings, limited cooperation from several crypto services, and reliance on loopholes in jurisdictions.

The group also pointed to “overrelationship on law enforcement,” as many crypto companies refuse to act, even when civil court orders are concluded, unless forced by the authorities.

“This is a major global risk due to the speed at which North Korea can chain stolen funds for weapons and nuclear programs,” Zero Shadow noted.

Bibit co-founder Ben Zhou said the company has increased its security since the attack in February and added that “we can no longer operate on silos when dealing with these challenges.”

Lazarus Bounty Website – Bybit

At the time of reporting, data from the Lazarus Bounty website was created by BYBit to track stolen funds and provide rewards for recovery, but more than 80% of the stolen funds are in darkness, indicating a 20% increase since early July.

In late February, hackers intercepted what was considered a routine transfer of ether from Bibit’s offline cold wallet to hot wallet, rerouteing and controlling about $1.5 billion in cryptography. The FBI later confirmed that the violation was made by the North Korean state-sponsored Lazarus group, marking the largest code robbery on record.