Greek authorities carried out the country’s first-ever crypto seizure after tracing funds linked to the record-breaking $1.4 billion hack of crypto exchange Bybit earlier this year.

The Hellenic Anti-Money Laundering Authority issued a freezing order on a suspect wallet following a months-long investigation aided by blockchain analytics firm Chainalysis.

The operation targeted funds allegedly stolen in February’s Bybit breach, which has been widely attributed to North Korea’s Lazarus Group.

The Bybit hack, which ranks among the largest crypto exchange breaches in history, saw attackers exploit vulnerabilities in the platform’s private key management systems to drain roughly $1.4 billion worth of Ethereum (ETH).

The stolen funds were rapidly laundered through an intricate web of blockchain transactions designed to obscure their origins, making recovery efforts challenging for global authorities.

The Greek seizure marked a milestone for local law enforcement in digital crime prevention. It was made possible by the Authority’s strategic investment in Chainalysis Reactor in 2023, a blockchain tracing platform procured through regional partner Performance Technologies.

The local technology provider also provided analysts with training and operational support ahead of the case. Using Reactor, Greek investigators tracked suspicious crypto transactions that ultimately linked a suspect wallet to the original Bybit theft.

Officials then froze the assets, removing control from illicit actors and transferring the case to prosecuting authorities for further legal action.

Kyriakos Pierrakakis, Greece’s Minister of Economy and Finance, hailed the seizure as a demonstration of modern tools strengthening anti-financial crime efforts.

Analysts said the successful seizure underlines how blockchain’s public ledger can aid global law enforcement despite sophisticated laundering tactics employed by groups like Lazarus, which has targeted crypto exchanges worldwide to fund North Korea’s weapons programs.

Chainalysis described the case as proof that combining technology, training, and international cooperation can erode criminal anonymity and bolster trust in digital asset markets.

Mentioned in this article

Crypto Journalist

Anas Hassan

Crypto Journalist

Anas Hassan

About Author

Anas is a crypto native journalist and SEO writer with over five years of writing experience covering blockchain, crypto, DeFi, and emerging tech.

Share

Last updated: 

July 9, 2025

Hellenic Anti-Money Laundering Authority in Greece achieved the country’s first-ever cryptocurrency asset freezing, recovering funds directly linked to the $1.5 billion Bybit exchange hack attributed to North Korea’s Lazarus Group.

The landmark operation utilized Chainalysis Reactor blockchain analysis tools to trace stolen funds through complex laundering schemes.

The analysis establishes irrefutable on-chain evidence that connects seized assets to the February 2025 cyber heist.

The investigation began when authorities spotted a suspicious crypto transaction months after the Bybit attack.

Using advanced blockchain analysis capabilities acquired in 2023, Greek investigators visualized fund flows and definitively linked cryptocurrency in a suspect wallet to primary wallets used in the exchange breach.

The coordinated international response comes as 32.78% of the stolen $1.4 billion remained traceable nearly five months after the attack, with a massive 62.04% having gone dark and 5.18% successfully frozen.

Blockchain Analysis Enables International Law Enforcement Breakthrough

Greece’s success stemmed from strategic preparation, with the Hellenic Authority investing in Chainalysis Reactor capabilities through its regional partner, Performance Technologies, in 2023.

The blockchain analysis revealed that North Korean hackers immediately laundered the stolen Ethereum through intricate transaction webs designed to obscure the money trail.

Chainalysis confirmed the initial compromise occurred via social engineering, with attackers executing phishing attacks against cold wallet signers to manipulate multi-signature implementations.

Bybit CEO Zhou described the devastating moment he learned of the breach, initially believing 30,000 ETH worth $82 million was affected before discovering all 401,000 ETH ($1.4 billion) had vanished.

The exchange processed 350,000 withdrawal requests within 10 hours and 580,000 by Saturday, maintaining operations to preserve customer confidence.

Security analysts confirmed the Lazarus Group moved funds rapidly through decentralized exchanges, mixers, and cross-chain bridges to evade tracking.

The cybercriminals converted 86.29% of stolen funds into 12,836 Bitcoin distributed across 9,117 wallets, primarily using Wasabi, CryptoMixer, Railgun, and Tornado Cash for obfuscation.

Global Crackdown Targets Crypto Laundering Infrastructure

As Greece took a step, Germany has taken its own significant action, seizing €34 million ($38 million) in crypto from the eXch platform on May 8 as part of ongoing investigations into the Bybit hack money laundering.

The seizure marked the third-largest crypto confiscation in the history of the German Federal Criminal Police Office, effectively shutting down the privacy-centric swapping service.

German authorities dismantled eXch after determining that the platform had laundered over €1.75 billion ($1.9 billion) in cryptocurrency, with a significant portion suspected to have originated from criminal activities.

The investigation revealed eXch ignored repeated warnings, refused to block malicious addresses, and failed to comply with regulatory freeze orders.

ZachXBT confirmed eXch processed funds from multiple high-profile incidents, including multisig wallet exploits, the $243 million Genesis creditor heist, and numerous phishing operations.

The platform marketed itself as privacy-centric, offering cross-blockchain exchanges without identity verification or anti-money laundering compliance.

Despite claiming a shutdown in April, eXch continued operations through backend APIs while websites went offline.

TRM Labs revealed that the platform never truly ceased functioning, allowing criminal groups, including Lazarus, to continue laundering activities through signature mixing pools that obscured the origins of the funds.

As it stands now, recovery efforts united 12 organizations, including Mantle, Paraswap, and blockchain investigators, earning bounty hunters $2.2 million USDT for assistance.

Despite these efforts, organized crime remains a significant threat to the cryptocurrency industry.

Between June and July, Taiwan’s BitoPro has lost $11.5 million through exposed wallets during system upgrades, and Brazil’s C&M Software attack resulted in $40 million crypto laundering.

Most significantly, Iran’s largest cryptocurrency exchange, Nobitex, confirmed a $73 million security breach on June 19, with unauthorized access detected in its hot wallet infrastructure, which subsequently resulted in over $90 million being drained.

In fact, just today, the decentralized exchange GMX is believed to have suffered a $42 million exploit, with digital assets reportedly drained from its vaults.

For Bybit, the exchange has launched a bounty program offering 10% rewards on recovered funds, totaling up to $140 million for successful asset retrieval.