October DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsWindows FixRecommendedWindows errors stealing your time? Find the fix fastScan stability, cleanup and performance issues.Fix NowOctober DealsAmazon USDeal season is back - check today's better picksAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
The Finance Base
The Money Desk · Blog
Re:

FBI Attributes Bybit’s $1.5B Crypto Theft to North Korea; Bybit Names Lazarus Group

The FBI blamed North Korea for approximately $1.5 billion in virtual assets stolen from Bybit, naming the activity TraderTraitor. Bybit separately described a Safe{Wallet} credential compromise and called the incident a Lazarus Group attack.
From TheFinanceBase Team3 min to read
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The FBI said North Korea was responsible for approximately $1.5 billion in virtual assets stolen from Bybit on or about February 21, 2025. In its February 26, 2025 public alert, the agency called the specific activity “TraderTraitor.” Bybit separately described the attack as Lazarus Group activity; those names come from different sources, not from the FBI alert itself.

Who did the FBI say hacked Bybit?

The FBI attributed the theft to North Korea. Its February 26, 2025 alert said the country was responsible for approximately $1.5 billion in virtual assets taken from the exchange on or about February 21, 2025, and used “TraderTraitor” for the activity.

Bybit’s own February 26 statement called the incident a Lazarus Group attack. That is the company’s characterization; the FBI alert named TraderTraitor and attributed the theft to North Korea. The distinctions matter: “North Korea” is the FBI’s attribution, “TraderTraitor” is the FBI’s label for the activity, and “Lazarus Group” is the name Bybit used.

How did the Bybit theft happen?

Bybit’s preliminary forensic account said a developer’s credentials at Safe, the third-party wallet infrastructure provider, had been compromised. Bybit said this gave the attacker access to Safe{Wallet} infrastructure and enabled the attacker to deceive signers into approving a malicious transaction. Bybit also said its reviewers found no indication that Bybit’s own infrastructure had been compromised.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
#1 Best Overall
Sale
Ledger Nano X - Classic Crypto Wallet with Bluetooth
  • Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
  • Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
  • Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
  • Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
  • Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.

A Japan Financial Services Agency retrospective synthesis of public information describes the sequence in more technical terms: malicious JavaScript was served through Safe infrastructure, signers were shown a manipulated transaction, and contract redirection enabled the theft. That account draws on public reporting and cited source material; it is not a technical finding published by the FBI. The available accounts therefore point to a compromise at the third-party wallet-infrastructure and transaction-approval boundary, rather than an established breach of Bybit’s own systems.

What happened to the stolen crypto?

The FBI said the assets were being converted into Bitcoin and other virtual assets, then dispersed across thousands of addresses on multiple blockchains. It warned that further laundering and conversion into fiat currency were expected. The approximately $1.5 billion figure is the FBI’s estimate of the value stolen around the incident date; it is not a statement of the assets’ current value or present location.

Rank #2
TANGEM Crypto Wallet Pack of 2 – Trusted Cold Storage Hardware Wallet
  • Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
  • Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
  • Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
  • Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
  • Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets

The FBI asked cryptocurrency exchanges, bridges, RPC node operators, blockchain analytics firms, decentralized-finance services, and other virtual-asset providers to block transactions with, or derived from, the identified addresses. That request reflects how tracing and interrupting a cross-chain flow can depend on many services—not just the exchange that was attacked.

How did Bybit respond, and what does recovery mean?

Bybit’s retrospective timeline says the exchange resumed normal withdrawal activity after the incident, ran a recovery bounty, and—with support from industry firms—closed its ETH client-asset gap within 72 hours. These are Bybit’s reported operational and reserve milestones, not findings in the FBI alert. Closing a client-asset gap describes Bybit’s reported ability to cover that shortfall; it does not mean the stolen assets themselves had all been recovered.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
Trezor Safe 3 Crypto Hardware Wallet with Secure Element
  • Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
  • Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
  • Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
  • Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
  • Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery

In an August 7, 2026 announcement, Bybit said it had filed a civil case in the U.S. District Court for the District of Columbia and obtained a preliminary injunction intended to preserve identified assets while the case proceeded. The company reported that approximately US$48.4 million had been recovered and over approximately US$30.5 million had been frozen across more than 28 exchanges and custodians. Bybit said the proceedings remained ongoing; those figures and the legal status are the company’s dated account, not independently verified here against a court docket or order.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What this incident shows about crypto custody

The incident illustrates why custody is not only a question of where crypto is held. A transaction can involve an exchange, a third-party wallet provider, the people approving a transaction, and software that presents transaction details for review. The available accounts do not establish that a particular consumer product would have prevented this attack, so the incident should not be treated as proof that a specific wallet or security device is a solution.

Rank #4
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen
  • UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
  • EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
  • ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
  • SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
  • EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Control point What the accounts establish
Exchange infrastructure Bybit said its reviewers found no indication that its own infrastructure was compromised.
Third-party wallet infrastructure Bybit said compromised Safe developer credentials gave the attacker access to Safe{Wallet} infrastructure.
Transaction approval Bybit said signers were deceived into approving a malicious transaction; the Japan FSA synthesis describes signers seeing a manipulated transaction.
Tracing and disruption The FBI asked a broad set of virtual-asset providers to block transactions involving identified addresses or funds derived from them.

The key distinction is between the FBI’s attribution and Bybit’s technical account: the FBI identified North Korea and the TraderTraitor activity, while Bybit described how compromised third-party credentials and a deceptive signing flow enabled the theft. The later recovery and litigation figures are Bybit-reported snapshots, not a final accounting of the case.

Quick Recap

SaleBestseller No. 1
Ledger Nano X - Classic Crypto Wallet with Bluetooth
Ledger Nano X - Classic Crypto Wallet with Bluetooth
Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
$79.00
Best Value
Ledger Nano S Plus - Classic Crypto Wallet
  • All your digital assets in one place. You can manage thousands of crypto including Bitcoin, Ethereum, Solana, Tether and more.
  • Defend your identity against hackers: secure your online accounts with passwordless, hardware backed, 2FA logins for all your favorite apps and websites.
  • Connectivity: USB-C cable connection only. No Bluetooth.Compatible with the Ledger Wallet crypto app, both desktop (Windows, macOS, Linux) and mobile (Android only). Not compatible with iOS.
  • Protect your digital assets with the industry's best security: keep your private keys offline in your private signer, battle-tested by the Donjon's white hat hackers, CC EAL 6+ certified Secure Element, constantly updated Ledger OS.
  • Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More post from the Money Desk

  1. The Money DeskBlogTheFinanceBase09 OCT 267 minMortgage Escrow FAQs: Taxes, Insurance, Shortages, and Refunds
  2. The Money DeskBlogTheFinanceBase09 OCT 265 minHow Mortgage Escrow Accounts Work and What Homeowners Pay For
  3. The Money DeskBlogTheFinanceBase09 OCT 265 minHow to Read a Stock Chart, Volume and Market-Cap Data
Recommended PC Tool
Recommended PC Tool
Crashes, No Sound, or Screen Glitches?Free driver scan
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.