North Korea-affiliated hackers may have scaled back their operations in the second half of 2024 while preparing for what became the largest crypto hack in history.<\/p>\n
The crypto industry was rocked by the enormous hack<\/a> on Feb. 21 when Bybit lost over $1.4 billion<\/a> to the infamous North Korean Lazarus Group<\/a>, which seems to have prepared the attack months in advance.<\/p>\n According<\/a> to blockchain analytics firm Chainalysis, illicit activity tied to North Korean cyber actors sharply declined after July 1, 2024, despite a surge in attacks earlier that year.<\/p>\n The slowdown in crypto hacks by North Korean agents had raised significant red flags, according to Eric Jardine, Chainalysis cybercrimes research Lead.<\/p>\n North Korean hacking activity before and after July 1. Source: <\/em>Chainalysis<\/em><\/a><\/p>\n North Korea\u2019s slowdown \u201cstarted when Russia and DPRK [North Korea] met for their summit that led to a reallocation of North Korean resources, including military personnel to the war in Ukraine,\u201d Jardine told Cointelegraph during the Chainreaction<\/a> show on March 26, adding:<\/p>\n \u201cSo, we speculated in the report that there might have been additional things unseen in terms of resources reallocation from the DPRK, and then you roll forward into early February, and you have the Bybit hack.\u201d<\/p>\n https:\/\/t.co\/jOlqMt4Hag<\/a><\/p>\n \u2014 Cointelegraph (@Cointelegraph) March 26, 2025<\/a><\/p>\n \u201cThe slowdown that we observed could have been a regrouping to select new targets, probe infrastructure, or it could have been linked to those geopolitical events,\u201d he added.<\/p>\n Related: <\/strong><\/em>Hyperliquid whale still holds 10% of JELLY memecoin after $6.2M exploit<\/strong><\/em><\/a><\/p>\n It took the Lazarus Group 10 days to launder<\/a> 100% of the stolen Bybit funds through the decentralized crosschain protocol THORChain, Cointelegraph reported on March 4.<\/p>\n Still, blockchain security experts were hopeful that a portion of the funds could be frozen and recovered by Bybit. As of March 20, over 80% of the stolen $1.4 billion<\/a> was still traceable as blockchain investigators continue their efforts to freeze and recover the funds.<\/p>\n Related: <\/strong><\/em>Polymarket faces scrutiny over $7M Ukraine mineral deal bet<\/strong><\/em><\/a><\/p>\n The Bybit attack highlights that even centralized exchanges with strong security measures remain vulnerable to sophisticated cyberattacks<\/a>, analysts said.<\/p>\n The attack shares similarities with the $230 million WazirX<\/a> hack and the $58 million Radiant Capital hack<\/a>, according to Meir Dolev, co-founder and chief technical officer at Cyvers.<\/p>\n Dolev said the Ethereum multisig cold wallet was compromised through a deceptive transaction, tricking signers into unknowingly approving a malicious smart contract logic change.<\/p>\n \u201cThis allowed the hacker to gain control of the cold wallet and transfer all ETH to an unknown address,\u201d Dolev told Cointelegraph.<\/p>\n North Korea hacking activity. Source: Chainalysis<\/em><\/p>\n Throughout 2024, North Korean hackers stole over $1.34 billion worth of digital assets across 47 incidents, a 102% increase from the $660 million stolen in 2023, according<\/a> to Chainalysis data.<\/p>\n This accounted for 61% of the total crypto stolen in 2024.<\/p>\nHow hackers staged the world\u2019s biggest crypto hack<\/h2>\n