One year ago this week, on February 21, 2025, North Korean state-sponsored hackers executed the largest cryptocurrency theft in history — draining $1.46 billion in Ethereum from Dubai-based exchange Bybit's cold wallet. The attack, attributed to the Lazarus Group by both Elliptic and the FBI, was...
"Bybit is solvent even if this hack loss is not recovered. All of clients assets are 1 to 1 backed, we can cover the loss." — Ben Zhou, CEO, Bybit
One year ago this week, on February 21, 2025, North Korean state-sponsored hackers executed the largest cryptocurrency theft in history — draining $1.46 billion in Ethereum from Dubai-based exchange Bybit's cold wallet. The attack, attributed to the Lazarus Group by both Elliptic and the FBI, was not merely a record-breaking heist. It was an inflection point that revealed the structural fragility of centralized exchange custody, the inadequacy of international enforcement against state-sponsored cyber theft, and the degree to which the crypto economy remains a subsidy for hostile regimes.
Twelve months later, the picture is grimmer than most in the industry want to admit. According to Elliptic's anniversary analysis published February 21, 2026, the DPRK stole a record $2 billion in cryptoassets during 2025, bringing its known cumulative haul to over $6 billion. The pace has accelerated into 2026: Elliptic recorded roughly twice as many exploits in January 2026 as during the same month a year earlier. The industry's response — bounty programs, proof-of-reserves audits, and MPC wallet adoption — has been meaningful but demonstrably insufficient. North Korea has not only continued its campaign; it has evolved, shifting from infiltrating crypto projects to building them from scratch.
The Bybit hack was not a brute-force exploit. It was a surgical supply-chain attack. According to NCC Group's technical analysis, the attackers compromised a developer machine at Safe{Wallet}, the widely used multisig platform, injecting malicious JavaScript into the frontend code. The modification was specifically targeted: the application functioned normally for every transaction except when Bybit was about to execute a transfer from its cold wallet. At that moment, the transaction was silently altered to redirect 401,347 ETH to an attacker-controlled address.
The sophistication of the attack underscored a critical vulnerability: the trust chain between exchanges and their third-party infrastructure providers. Bybit's own security protocols were not directly breached. Rather, the compromise occurred upstream, in the software supply chain of a tool that hundreds of DAOs, protocols, and exchanges rely upon. This is the equivalent of a bank vault being compromised not by cracking the safe, but by corrupting the manufacturer of the lock.
Within 48 hours, at least $160 million had been moved. By February 26, 2025, over $400 million had been processed through various laundering channels, demonstrating what Elliptic described as "unprecedented operational efficiency."
The laundering of Bybit's stolen funds followed a now-documented playbook. The attackers first converted all stolen tokens to Ether — because ETH, unlike many ERC-20 tokens, cannot be frozen by a centralized issuer — then routed funds through decentralized exchanges and cross-chain bridges to avoid asset freezing.
A central node in the laundering operation was eXch, a cryptocurrency mixing service that processed an estimated $200 million of the stolen Bybit funds. In April 2025, eXch announced it would shut down amid allegations of complicity. On April 30, German authorities seized the platform, confiscating €34 million in crypto and 8 terabytes of data. The service had processed an estimated $1.9 billion in total transactions since launch. However, according to TRM Labs, eXch continued to offer API access to partners even after the public shutdown, and on-chain laundering activity persisted.
As of the one-year anniversary, Bybit CEO Ben Zhou reported that 88.87% of the stolen assets remain traceable. However, "traceable" is not "recoverable." Only approximately 3% of the funds have been successfully frozen. The vast majority — over $1 billion — was laundered through suspected Chinese over-the-counter (OTC) trading desks, rendering it practically irrecoverable despite being analytically visible on-chain.
Bybit launched its Lazarus Hack Bounty Program, offering a $140 million reward (10% of recovered funds) to entities that could freeze or trace stolen assets. Bybit itself replenished its reserves within 72 hours of the attack, confirmed by a Hacken proof-of-reserves audit — a crisis-management feat that prevented a full-scale bank run but did not change the fundamental reality that $1.46 billion was permanently extracted from the ecosystem.
The Bybit hack was the dominant event in a historically bad year for crypto security. According to Chainalysis's 2025 Crypto Crime Report, total industry-wide theft reached $3.4 billion — a slight increase from 2024's $3.38 billion. The Bybit hack alone represented 44% of the annual total.
Key data points from the Chainalysis report:
A critical structural observation: the DPRK is achieving larger thefts with fewer incidents. In 2025, North Korean-linked actors executed 74% fewer known attacks while stealing 51% more. This is not a volume operation — it is a precision campaign targeting the highest-value vulnerabilities in the ecosystem.
Elliptic's February 2026 anniversary report documents a disturbing evolution in North Korean tactics across three vectors:
1. Social Engineering Campaigns
Two ongoing campaigns — codenamed DangerousPassword and Contagious Interview — have netted $37.5 million since January 1, 2026 alone. DangerousPassword operates through compromised social media accounts, with operatives posing as conference acquaintances and inviting targets to video calls. When the victim encounters a staged audio error, they are directed to install a "fix" that is actually malware designed to extract private keys, seed phrases, and stored passwords. Contagious Interview uses fabricated job opportunities, luring targets into fake onboarding processes that require running malicious code repositories.
2. IT Worker Infiltration
Reports of suspected DPRK IT workers continue to surface across the crypto industry. This is a slower, more patient operation: workers embed themselves in legitimate projects, performing adequate work during their tenure while mapping internal systems and identifying high-value targets. Amazon alone blocked 1,800 suspected DPRK-linked fake IT worker accounts.
3. Building Entire Projects from Scratch
The most alarming evolution is documented in Elliptic's investigation of the Tenexium incident. On January 1, 2026, Tenexium.io — a project linked to the Bittensor (TAO) ecosystem — went offline, coinciding with suspicious outflows of $2.5 million in liquidity from its treasury wallet. Subsequent investigation revealed that some of Tenexium's contributors were suspected DPRK IT workers, with a high-confidence DPRK persona attached to the project. If confirmed, this represents a fundamental tactical shift: rather than infiltrating existing projects, operatives are building honeypot projects from the ground up to attract deposits and liquidity.
The year since the Bybit hack has catalyzed meaningful security improvements across the industry:
Multi-Party Computation (MPC) Adoption. The global crypto wallet market surged 32% to $19 billion in 2025, driven substantially by institutional demand for MPC-based custody solutions. Unlike traditional multisig, MPC distributes key material across multiple parties without ever assembling a complete private key, eliminating the single points of failure that the Bybit attack exploited. Fireblocks alone now serves 1,800+ institutional clients. The trend is clear: seed phrases are disappearing from institutional workflows.
Proof of Reserves Standardization. Bybit's pre-existing monthly Proof of Reserves audits with Hacken proved critical during the crisis, enabling the exchange to demonstrate solvency and prevent a cascading withdrawal crisis. Multiple major exchanges have since initiated additional audits and published updated security disclosures.
Regulatory Reassessment. According to CSIS, agencies in the United States, Singapore, and the EU have begun reviewing tighter requirements for wallet audits, risk disclosures, operational monitoring, cold-wallet verification, software-supply-chain controls, and incident-response transparency. The Wilson Center emphasized that cooperation — domestically and internationally — is imperative, particularly given the limited window to freeze or recover stolen funds.
Tiered Wallet Architecture. Professional exchanges now implement multi-tiered strategies: hot wallets (2-5% of assets) for immediate operations, warm wallets (10-20%) with multi-signature requirements across geographically distributed hardware, and cold storage (75-90%) using Shamir's Secret Sharing with keys split across multiple secure locations.
Yet the fundamental problem persists: these improvements address the technical attack surface while the primary attack vector remains human. Social engineering — not code exploits — is how the DPRK gains initial access. No amount of MPC key sharding prevents an employee from running malicious code on a compromised video call.
Viewed through the economic value distribution framework, the security landscape reveals a troubling subsidy dynamic. The $3.4 billion stolen in 2025 represents approximately 25% of the blockchain industry's estimated $13.7 billion in legitimate on-chain revenue. Put differently: for every $4 the industry earns in genuine fee revenue, approximately $1 is extracted by attackers.
This $3.4 billion in losses does not include the indirect costs — the security infrastructure spending, insurance premiums, compliance overhead, and reputational damage that cascade through the ecosystem. When the crypto wallet security market alone is $19 billion, and annual theft exceeds $3 billion, the industry is spending far more on defending against value extraction than it generates in organic economic activity.
The DPRK's $6.75 billion cumulative haul is particularly striking in context. It exceeds the total annual fee revenue of the entire blockchain ecosystem. North Korea has, in effect, extracted more value from crypto than crypto has generated in legitimate base-layer fees across all networks combined in any single year.
The Bybit hack ($1.46B) was not an anomaly — it was a capability demonstration. Twelve months later, DPRK-linked exploits have doubled in frequency, and 2026 is on pace to exceed 2025's record theft.
Only ~3% of Bybit's stolen funds have been frozen despite 88.87% remaining "traceable." On-chain visibility does not equal recoverability — the gap between analytics and enforcement is the industry's most dangerous blind spot.
North Korea's tactical evolution is accelerating. The shift from social engineering to IT worker infiltration to building entire honeypot projects represents a qualitative leap in sophistication. The Tenexium incident, if confirmed as a DPRK front, would be the first known case of state-sponsored actors creating crypto projects as attack infrastructure.
The industry's security response is necessary but insufficient. MPC adoption, proof-of-reserves, and tiered custody architectures reduce technical attack surface but do not address the human-factor vulnerabilities that remain the primary entry point.
Crypto's security cost structure is unsustainable. Annual theft exceeding $3 billion against $13.7 billion in on-chain revenue means the industry loses roughly $1 to attackers for every $4 in legitimate economic activity — a ratio that would be considered an existential crisis in any traditional financial system.
The one-year anniversary of the Bybit hack is not a moment for the industry to celebrate its resilience. Bybit survived because it had the balance sheet to absorb a $1.5 billion loss. Most exchanges do not. The next Bybit-scale hack — and Elliptic's data suggests it is a matter of when, not if — may hit a platform without the reserves to replenish.
The deeper structural issue is that crypto's security problem is now a national security problem. The DPRK's $6.75 billion cumulative theft finances weapons programs under international sanctions. The CSIS and Wilson Center have both called for urgent regulatory and enforcement action. Yet the industry's deregulatory momentum — driven by the same administration that is loosening crypto oversight — runs directly counter to the security imperatives that the Bybit hack laid bare.
The question for the next twelve months is straightforward: can the crypto industry's security infrastructure outpace the evolution of the most sophisticated state-sponsored theft operation in history? The data from the first year suggests the answer is no.