The Taiwanese cryptocurrency exchange BitoPro claims the North Korean hacking group Lazarus is behind a cyberattack that led to the theft of $11,000,000 worth of cryptocurrency on May 8, 2025.

The company has attributed the attack to Lazarus based on the evidence recovered from its internal investigations. It notes that the attack patterns and methodology closely resemble those used in past cyberattacks.

“The attack methodology bears resemblance to patterns observed in multiple past international major incidents, including illicit transfers from global bank SWIFT systems and asset theft incidents from major international cryptocurrency exchanges,” reads the announcement.

“These attacks are attributed to the North Korean hacking organization Lazarus Group.”

BitoPro is a cryptocurrency exchange that caters primarily to Taiwanese users, supporting fiat deposits and withdrawals in TWD and a selection of crypto assets.

It has over 800,000 registered users and a daily trading volume of roughly $30 million.

On May 8, 2025, during a hot wallet system update, hackers performed unauthorized withdrawals from an old hot wallet across multiple blockchains, including Ethereum, Tron, Solana, and Polygon.

After the theft, stolen funds were laundered through DEXs and mixers like Tornado Cash, ThorChain, and Wasabi Wallet.

BitoPro was slow in admitting the incident, only confirming it publicly on June 2, noting that all operations were unaffected and impacted hot wallets were replenished by available reserves.

The investigation into the hack now confirmed that there was no internal involvement, even though the attackers launched a social engineering attack and implanted malware on the device of an employee managing cloud operations.

Through this infection, the attackers hijacked AWS session tokens to bypass multi-factor authentication (MFA) and gain control over BitPro’s cloud infrastructure.

Next, the command-and-control (C2) server delivered commands to the implant that injected scripts into the hot wallet host as the attack was being prepared.

When the wallet was upgraded and assets transferred, the attackers stole crypto while simulating normal operational behavior to evade immediate detection.

Once BitoPro detected the compromise, they shut down the hot wallet system and rotated the cryptographic keys. However, roughly $11 million worth of cryptocurrency had already been stolen.

The company informed the applicable authorities and engaged with an external cybersecurity expert to investigate the incident, a process completed on June 11.

The North Korean Lazarus group is notorious for targeting cryptocurrency and decentralized finance entities. The hacking group is believed to be responsible for record-breaking digital asset heists, most recently, the $1.5 billion theft from Bybit.

If you know anything about a crypto hack, you’ve probably heard of the Lazarus Group.

They’re pretty much the final boss of crypto cybercrime – a North Korean state-backed hacking group responsible for some of the biggest thefts in the industry, including the Bybit hack earlier this year.

They’ve always carried this boogeyman of blockchain, mysterious vibe. But a new BitMEX report pulled back the curtain a bit.

And turns out… they’re not as flawless as some might think.

Over time, Lazarus seems to have split into smaller teams, and not all of them are equally skilled. Some are pros. Others – not so much.

Case in point: a BitMEX employee got a message on LinkedIn about joining a crypto project.

If you’ve followed Lazarus’ past scams, you know this is something they’ve done before – so the employee flagged it to the security team.

They were sent a GitHub repo with a Next.js/React project that – surprise – contained malware.

The attacker wanted them to run the code locally, which would’ve let malicious scripts execute on the employee’s computer.

Now, here’s what BitMEX found in the code:

• It used JavaScript’s eval() function, which takes a piece of text and treats it like code. So if it says “delete everything,” your computer will actually try to run that command – and that opens the door for attackers to sneak in harmful code;

• The malware tried to connect to suspicious URLs to download even more code – the kind of infrastructure Lazarus has used before in past attacks;

• It collected data like usernames, IP addresses, operating systems, and uploaded all of it to… wait for it… a public Supabase database

Yes. Public.

This is like using Google Sheets to store stolen data… and then leaving the spreadsheet unlocked.

The BitMEX team took a look and found nearly 900 logs from infected machines.

And in one of them, they caught a big oopsie: a hacker forgot to turn on their VPN and exposed their real location in Jiaxing, China.

Instead of treating this oopsie as a one-off discovery, BitMEX saw an opportunity here – they built a tool to keep checking the database.

This lets BitMEX:

• Track new infections as they happen;

• Figure out who’s being targeted – devs, exchange workers, or random users;

• Watch for repeat mistakes by the hackers (like more IP leaks);

• Potentially map out patterns – like locations, time zones, or organizational targets.

Lazarus is still dangerous – no doubt about it.

But the more we learn about their tricks (and their mistakes), the easier it becomes to protect people from falling for them.

Six malicious packages have been identified on npm (Node package manager) linked to the notorious North Korean hacking group Lazarus.

The packages, which have been downloaded 330 times, are designed to steal account credentials, deploy backdoors on compromised systems, and extract sensitive cryptocurrency information.

The Socket Research Team discovered the campaign, which linked it to previously known Lazarus supply chain operations.

The threat group is known for pushing malicious packages into software registries like npm, which is used by millions of JavaScript developers, and compromising systems passively.

Similar campaigns attributed to the same threat actors have been spotted on GitHub and the Python Package Index (PyPI).

This tactic often allows them to gain initial access to valuable networks and conduct massive record-breaking attacks, like the recent $1.5 billion crypto heist from the Bybit exchange.

The six Lazarus packages discovered in npm all employ typosquatting tactics to trick developers into accidental installations:

1. is-buffer-validator – Malicious package mimicking the popular is-buffer library to steal credentials.
2. yoojae-validator – Fake validation library used to extract sensitive data from infected systems.
3. event-handle-package – Disguised as an event-handling tool but deploys a backdoor for remote access.
4. array-empty-validator – Fraudulent package designed to collect system and browser credentials.
5. react-event-dependency – Poses as a React utility but executes malware to compromise developer environments.
6. auth-validator – Mimics authentication validation tools to steal login credentials and API keys.

The packages contain malicious code designed to steal sensitive information, such as cryptocurrency wallets and browser data that contains stored passwords, cookies, and browsing history.

They also load the BeaverTail malware and the InvisibleFerret backdoor, which North Koreans previously deployed in fake job offers that led to the installation of malware.

“The code is designed to collect system environment details, including the hostname, operating system, and system directories,” explains the Socket report.

“It systematically iterates through browser profiles to locate and extract sensitive files such as Login Data from Chrome, Brave, and Firefox, as well as keychain archives on macOS.”

“Notably, the malware also targets cryptocurrency wallets, specifically extracting id.json from Solana and exodus.wallet from Exodus.”

All six Lazarus packages are still available on npm and the GitHub repositories, so the threat is still active.

Software developers are advised to double-check the packages they use for their projects and constantly scrutinize code in open-source software to find suspicious signs like obfuscated code and calls to external servers.

The Bybit CEO is launching a new initiative that calls on the crypto community to help retrieve digital assets stolen by a notorious group of North Korean hackers.

Ben Zhou, Bybit’s co-founder and CEO, says on the social media platform X that they have launched a bounty program website to target the Lazarus Group after the cybercriminal outfit is believed to have stolen $1.4 billion in digital assets from their platform last week.

“Join us on war against Lazarus: http://lazarusbounty.com.

Industry first bounty site that shows aggregated full transparency on the sanctioned Lazarus money laundering activities…

Becoming a bounty hunter by connecting your wallet and help tracing the fund, when your submitted bounty leads to freeze, bounty is paid upfront upon instantly at freezing. All freezer gets 5% of the bounty, exchange, mixers and all.”

Zhou also says they have assembled a team dedicated to keep the website current, and may expand it to include other victims of the Lazarus Group’s illicit activities.

“We have assigned a team to dedicate to maintain and update this website, we will not stop until Lazarus or bad actors in the industry is eliminated. In the future we will open it up to other victims of Lazarus as well.”

According to the crypto analysis firm Arkham, the attackers siphoned about $1.4 billion in Ethereum (ETH) and Lido Staked Ether (STETH), making the incident the largest known heist in crypto history.

Lazarus most likely compromised the exchange’s ETH wallet directly through Safe, the crypto wallet that Bybit was using, by accessing its Amazon Web Services (AWS) bucket, according to the Bybit CEO.

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Follow us on X, Facebook and Telegram

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Generated Image: Midjourney

Bybit announced a bounty platform designed to combat crypto-related crime titled LazarusBounty.com following.

The initiative employs a structured, four-pronged approach to identifying illicit activity, holding hackers accountable, and enhancing crypto security. 

The effort follows a hack perpetrated against Bybit on Feb. 21, which resulted in the loss of nearly $1.5 billion in Ethereum (ETH) and ETH synthetic tokens. According to blockchain security firm Elliptic, this is the largest hack in history.

War against Lazarus

LazarusBounty.com consolidates blockchain security data from leading firms, including Chainalysis, Arkham, and GoPlus, into a unified security repository. This real-time database provides investigators and the broader community with critical insights to detect, analyze, and counteract illicit activities. 

LazarusBounty.com mobilizes blockchain forensic specialists, such as ZachXBT and Yu Xian of SlowMist, to conduct in-depth investigations when significant breaches occur.

These experts have forensic tools and methodologies to trace stolen funds, identify attackers, and coordinate responses with law enforcement and affected platforms. The initiative is a proactive deterrent against cybercrime, strengthening the industry’s ability to respond to security threats.

Bybit CEO Ben Zhou said:

“In today’s blockchain landscape, transparency isn’t just a principle — it’s our most potent weapon against cybercrime. With LazarusBounty.com, we are taking a stand to ensure that every transaction is visible and every hacker is held accountable. Our multifive-pronged offensive is a clear message: if you steal, you will be found, and justice will be swift.”

Moreover, LazarusBounty.com has a bounty leaderboard that tracks and rewards contributions based on the effectiveness of efforts to recover stolen funds. The site catalogs verified intelligence, recognizing security researchers and ethical hackers who help unmask cybercriminals. 

An automated notification system enhances response times by immediately alerting exchanges and platforms to freeze illicitly obtained funds before they can be laundered.

Bybit has also assembled a security advisory board comprising chief security officers from major blockchain networks. This decentralized council collaborates to enhance security protocols, share intelligence, and reinforce protective measures across the crypto ecosystem.

Tracking the funds

According to on-chain data highlighted by Arkham, the funds extracted in the Bybit hack are being swapped for Bitcoin (BTC) and DAI via the multichain protocol Thorchain and the OKX Web3 Swap feature. So far, the hackers swapped $6.2 million to BTC.

Blockchain analytics platform SpotOnChain also noted that roughly $250 million has already been laundered.

Due to the structure of the attack and the subsequent laundering process, analysts suspect that the North Korean Lazarus Group is behind the Bybit hack.

Elliptic highlighted that Lazarus uses various layering tactics, including sending funds through numerous crypto wallets, using cross-chain bridges to transfer assets across blockchains, converting assets via decentralized exchanges or swap services, and leveraging mixers like Tornado Cash.

These techniques are intended to buy time for launderers before attempting to cash out the illicit funds. Lazarus seems to be currently performing the third step, using multichain solutions to layer funds.

Mentioned in this article