February 21, 2026, marks exactly one year since the Lazarus Group — North Korea's elite state-sponsored hacking collective — executed the largest cryptocurrency theft in history: $1.46 billion drained from Bybit's cold wallet in a single transaction. The attack was not a zero-day exploit or a sma...
"Unless there's a physical break-in, no one will be able to touch tokens." — Ben Zhou, CEO of Bybit, on the security overhaul following the $1.5 billion hack
February 21, 2026, marks exactly one year since the Lazarus Group — North Korea's elite state-sponsored hacking collective — executed the largest cryptocurrency theft in history: $1.46 billion drained from Bybit's cold wallet in a single transaction. The attack was not a zero-day exploit or a smart contract vulnerability. It was a compromised developer laptop, a trojanized Docker project, and a hijacked AWS session token. The most sophisticated custody infrastructure in crypto was undone by social engineering.
Twelve months later, the stolen funds are almost entirely laundered. But the Bybit hack was not the culmination of North Korea's crypto theft campaign — it was an inflection point. In 2025, DPRK-linked hackers stole $2.02 billion in cryptocurrency, a 51% year-over-year increase, pushing their all-time cumulative haul to $6.75 billion. Total industry-wide crypto theft reached $3.4 billion. North Korea accounted for 76% of all service compromises by value. And their tactics are evolving: from infiltrating projects to building fake ones from the ground up, from phishing emails to planting malicious packages in npm and PyPI, from targeting exchanges to embedding IT workers inside crypto companies themselves.
This report examines what we've learned in the year since the Bybit hack, how North Korea's crypto theft apparatus has adapted, and why the industry's response — while improved — remains structurally inadequate against a nation-state adversary.
The attack on Bybit began not with code, but with deception. On February 4, 2025 — seventeen days before the theft — a developer at Safe{Wallet}, the third-party multisig wallet provider used by Bybit, downloaded a trojanized Docker project onto their Apple macOS machine. The malware harvested AWS session tokens, bypassing multi-factor authentication entirely.
The attackers waited. When Bybit initiated a routine cold-to-warm wallet transfer requiring multiple approvals on February 21, the compromised Safe{Wallet} developer's access was weaponized. Malicious JavaScript was injected into the Safe{Wallet} UI — but only when Bybit's specific wallet address was accessed. The signers saw a legitimate-looking transaction. They approved it. 401,347 ETH — worth $1.46 billion at the time — was rerouted to attacker-controlled wallets.
The FBI officially attributed the attack to North Korea's Lazarus Group on February 26, 2025, confirming Elliptic's initial assessment. The forensic analysis by NCC Group and Sygnia later revealed the full kill chain: social engineering → laptop compromise → AWS credential theft → JavaScript injection → transaction manipulation. Not a single line of Bybit's own code was exploited.
This distinction matters. The attack exposed a fundamental architectural blind spot: even battle-tested multisig setups are only as secure as every third-party dependency in the signing pipeline.
The speed of DPRK laundering operations post-Bybit was unprecedented. Within 48 hours, $160 million had already been processed. By March 20, 2025 — less than a month after the hack — Bybit CEO Ben Zhou reported that 86.29% of the stolen ETH had been converted to Bitcoin.
Chainalysis research reveals a structured, multi-wave laundering pathway spanning approximately 45 days:
The dark service eXch played a central role in laundering approximately $200 million of the stolen Bybit funds before it was taken down — a case documented extensively by Elliptic.
As of early 2026, Zhou estimated that 68.57% of stolen assets remain traceable, 27.59% have gone dark, and 3.84% were frozen. Bybit's "Lazarus Bounty" program — offering 10% rewards for recovered funds — mobilized approximately 20 bounty hunters who earned over $4 million in rewards for helping recover $40 million. That's an 8.5% recovery rate against a $1.46 billion loss.
The Bybit hack, while the single largest incident, was part of a broader campaign. According to Chainalysis's 2025 Crypto Crime Report:
| Metric | Value | |--------|-------| | Total crypto stolen globally (2025) | $3.4 billion | | DPRK's share | $2.02 billion (59%) | | DPRK year-over-year increase | +51% | | DPRK cumulative all-time total | $6.75 billion | | Top 3 hacks' share of all service losses | 69% | | Personal wallet compromises | 158,000 incidents, 80,000+ victims | | Personal wallet losses | $713 million | | DPRK share of service compromises by value | 76% |
The pattern is clear: fewer attacks, larger hauls. North Korea is getting more efficient, not more prolific. The DPRK is achieving outsized returns by concentrating on high-value targets with deep access rather than spray-and-pray attacks.
Centralized services accounted for 88% of Q1 2025 losses. DeFi hacks, notably, remained suppressed relative to Total Value Locked — suggesting that protocol-level security has genuinely improved even as human-layer vulnerabilities widen.
The most alarming development revealed in Elliptic's 12-month anniversary analysis is the apparent shift from infiltrating crypto projects to building them from scratch.
The Tenexium Case: On January 1, 2026, a trading protocol called Tenexium launched on the Bittensor (TAO) network. Elliptic's research suggests a North Korean IT professional posed as the project lead. The platform attracted investment until it suddenly went offline, with $2.5 million in suspicious treasury outflows. If confirmed as a DPRK operation, Tenexium represents a fundamental tactical escalation: rather than compromising an existing project's developer, operatives built the entire project as a purpose-built trap.
This sits alongside two established DPRK attack campaigns that continued throughout 2025 and into 2026:
Elliptic recorded $37.5 million in combined gains from these two campaigns alone between January 1 and February 20, 2026. January 2026 saw twice as many exploits as January 2025.
In February 2026, security researchers uncovered the graphalgo campaign — a coordinated Lazarus Group operation planting malicious packages in npm and PyPI, the two largest open-source package registries used by developers worldwide.
The operation involved a fabricated company called Veltrix Capital (domain registered April 2025), which approached developers via LinkedIn, Facebook, and Reddit with blockchain-related job offers. Candidates were asked to work with code repositories containing trojanized packages — including a fake graphlib on npm and a fake networkx on PyPI.
One malicious npm package, bigmathutils, accumulated over 10,000 downloads before the payload was activated in a second version update. The final payload: a remote access trojan (RAT) with file access, command execution, and process control capabilities. The malware specifically checks for MetaMask wallets.
Git commit timestamps consistently show GMT+9 timezone activity — North Korean working hours. This is not a criminal gang. This is a state-run software supply chain attack targeting crypto developers at scale.
The Bybit hack did catalyze meaningful security improvements:
Bybit's Overhaul: The exchange deployed hardware security modules (HSMs) for cold wallet operations, expanded its internal security team, introduced incident-simulation drills, and redesigned multisig procedures to eliminate the specific weaknesses exploited in the attack. Zhou's post-hack statement — "Unless there's a physical break-in, no one will be able to touch tokens" — reflects a shift toward air-gapped signing infrastructure.
Safe{Wallet} Improvements: The incident exposed critical gaps in Safe{Wallet}'s infrastructure: no Subresource Integrity (SRI) hashing to detect front-end modifications, no real-time alerting for unauthorized code edits. Industry-wide recommendations now include cryptographic code signing, SRI deployment, multi-party code review for wallet UI updates, and Cloud Security Posture Management (CSPM) tools.
Regulatory Action: The FBI formally attributed the attack, the IC3 issued a public service announcement, and G7 nations announced plans to address North Korea's cyber threats through coordinated sanctions and intelligence sharing. Regulators globally are pushing for more aggressive KYC/AML requirements on exchanges and bridge protocols.
Bybit's Survival: Despite the largest hack in crypto history, Bybit survived — and grew. By the end of 2025, the exchange had crossed 80 million users globally, recorded $7.1 billion in daily trading volume, and ranked No. 5 among crypto spot exchanges. The crisis management — Zhou's immediate public transparency and commitment to honoring all user withdrawals — became an industry case study.
Despite these improvements, structural vulnerabilities remain:
The Human Layer Problem: Social engineering remains the primary attack vector across virtually all DPRK-attributed incidents. The Bybit hack, the Contagious Interview campaign, the graphalgo supply chain attack — all begin with a human making a reasonable-seeming decision. No amount of HSMs or multisig schemes can fully address this.
Irreversibility: As Zhou himself noted: "If you lose money or get scammed, tracing stolen funds is still possible in crypto, but everything moves so fast that by the time you get to it, the money is already gone." The 45-day laundering cycle is faster than most institutional response mechanisms.
Nation-State Asymmetry: The crypto industry is defending against a nation-state with approximately 6,000 trained cyber operatives, a $6.75 billion track record, and no legal accountability. Bounty programs and blockchain forensics are useful tools, but the 8.5% recovery rate on the Bybit hack illustrates the structural mismatch.
Third-Party Dependencies: The entire crypto custody stack relies on layers of third-party software — wallet UIs, cloud infrastructure, package registries, browser extensions. Each layer is a potential attack surface. The Bybit hack came through Safe{Wallet}; the next one could come through an npm package or a compromised CI/CD pipeline.
The Bybit hack anniversary is not a story about one exchange's vulnerability. It is a story about a structural mismatch between the crypto industry's open, composable, trust-minimized architecture and a nation-state adversary that has optimized for exploiting every seam in that architecture.
North Korea's $6.75 billion cumulative crypto theft operation is now one of the regime's primary revenue sources — estimated to fund a significant portion of its nuclear and missile programs. The operation is industrialized: purpose-built campaigns, fake companies, malicious open-source packages, embedded IT workers, and a laundering pipeline that moves faster than the industry can respond.
The uncomfortable truth is that the crypto industry's greatest strength — permissionless, irreversible, borderless transactions — is also its greatest vulnerability when the adversary is a nation-state with nothing to lose. Hardware security modules and subresource integrity checks are necessary but not sufficient. The next frontier of defense must address the human layer: continuous security awareness training, zero-trust access models for signing infrastructure, and industry-wide threat intelligence sharing that operates at the speed of the laundering pipeline itself.
One year after Bybit, the money is gone. The question is whether the lessons will last longer than the headlines.