Free tools Windows power users keep installed
One-click scans. No signup required.
North Korea-linked cyber actors stole approximately $1.46 billion from cryptocurrency exchange Bybit on February 21, 2025, making it the largest confirmed theft of digital assets. The FBI later attributed responsibility to the Democratic People’s Republic of Korea, while blockchain investigators and security firms commonly linked the operation to the Lazarus Group.
The attack did not defeat Ethereum’s cryptography. It compromised the process used to approve a legitimate-looking transaction from a Bybit cold wallet. That distinction explains why the incident matters to exchanges, custodians and individual crypto users alike.
As an Amazon Associate I earn from qualifying purchases.
What happened in the Bybit heist?
On February 21, 2025, attackers drained one of Bybit’s Ethereum cold wallets during what the exchange described as a routine transfer to a warm wallet. Bybit said the stolen assets were worth approximately $1.46 billion at the time. News reports and the FBI often rounded the figure to $1.5 billion because the dollar value changes with crypto prices.
Bybit’s published breakdown attributed the total to:
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
| Asset | Amount | Approximate value in Bybit’s report |
|---|---|---|
| ETH | 401,347 | $1.12 billion |
| stETH | 90,375 | $253.16 million |
| cmETH | 15,000 | $44.13 million |
| mETH | 8,000 | $23 million |
| Total | — | $1.46 billion |
These figures are Bybit’s incident accounting and represent a valuation around the time of the theft, not a permanently fixed dollar amount. The exchange said the funds were initially divided among 39 destination addresses. The FBI described the event as approximately $1.5 billion in stolen cryptocurrency, while Elliptic and Chainalysis called it the largest crypto theft on record.
That wording matters. It was the largest confirmed cryptocurrency or digital-asset theft, not necessarily the largest theft of any kind in history.
Bybit’s incident timeline and the FBI’s public statement provide the main official accounts.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →How could a cold wallet be drained?
A cold wallet is generally designed to keep private-key signing material offline or isolated from ordinary internet-connected systems. That reduces the risk of direct remote theft, but it does not make the entire transaction process safe by itself.
A large exchange still needs people and systems to authorize transfers. Those systems can include:
- signers’ computers and hardware devices;
- browser sessions and authentication credentials;
- the wallet’s web interface;
- transaction display and decoding tools;
- internal approval policies; and
- the smart contract holding the assets.
According to Bybit’s account, the incident involved a multisignature Safe wallet used for a cold-to-warm-wallet transfer. The signers were induced to approve a transaction that appeared legitimate but altered the wallet’s smart-contract logic. After that change, the attackers could move the assets.
Bybit’s preliminary investigations by Sygnia and Verichains pointed to malicious JavaScript affecting the Safe{Wallet} signing experience. Bybit described the event as involving phishing and spoofing of the Safe interface. Safe, however, said its core codebase and dependencies were not compromised and that no other Safe addresses were affected.
Recommended Free Tools
The most accurate summary is therefore not simply “Safe was hacked.” The evidence supports a compromise of the transaction-signing workflow, while the precise boundary between the web interface, delivery environment, signer systems and wallet contract remains important.
The central lesson is simple: cold storage protects key material, but it does not automatically protect the people, browsers, interfaces and policies used to authorize transactions.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide (4.9 App Store, 4.8 Google Play) - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Bybit’s account of the Safe-related incident is available in its security statement.
Why multiple signatures did not stop it
Multisignature wallets require approval from more than one authorized signer. That is usually safer than relying on one private key, because a single stolen credential should not be enough to spend the funds.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
But multisignature security depends on what the signers are actually approving. If several people see the same manipulated transaction display and approve it, the arrangement can turn coordinated review into coordinated authorization of the wrong action.
The failure mode is particularly serious when signers approve based on a simplified interface rather than independently checking:
- the destination contract and address;
- the function being called;
- the exact state change the transaction will create;
- the wallet’s owners and signing threshold; and
- whether the transaction matches the approved operational request.
A transaction that looks like an ordinary transfer in a web interface may, in the wrong circumstances, change the logic governing the wallet itself. That is why a “cold wallet” should be understood as one layer in a custody system, not as a complete security strategy.
Why investigators blamed Lazarus and North Korea
Attribution developed over time rather than appearing as an instantly proven conclusion.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchBlockchain investigators examined test transactions, related wallets, timing, wallet clusters and the way the stolen assets were moved after the breach. Elliptic and Chainalysis said the techniques and laundering patterns resembled earlier operations attributed to North Korea-linked actors.
On February 26, 2025, the FBI publicly stated that the DPRK was responsible for the Bybit theft. That official attribution strengthened the earlier assessments by private investigators, although the FBI’s announcement did not publish a complete, courtroom-style technical dossier identifying every operator or command relationship.
In general reporting, the attackers are widely described as the Lazarus Group. The FBI also uses the designation TraderTraitor for North Korean cyber actors targeting cryptocurrency businesses. Some threat-intelligence reporting uses APT38 for a financially motivated North Korean cluster.
Rank #3
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Those labels can overlap, but they are not interchangeable in every government or security-company taxonomy. The most careful wording is that the FBI attributed the theft to North Korea-linked actors and that investigators commonly associated the operation with Lazarus.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesRelevant sources include the FBI attribution notice, its Internet Crime Complaint Center advisory, and analyses from Chainalysis and Elliptic.
How the stolen funds were moved
Public blockchains made the theft visible, but visibility did not make recovery automatic.
The stolen assets were split among many addresses and moved through multiple wallets. Investigators followed wallet clusters, transaction paths and cross-chain activity as the attackers tried to make the funds harder to connect to the original theft.
Cross-chain movement can complicate monitoring because the assets leave the original network and may pass through different bridges, tokens, service providers or compliance environments. Exchanges and blockchain-analytics companies can flag addresses and interrupt some transfers, but enforcement is uneven across jurisdictions and services.
Three outcomes should not be confused:
- Tracing: identifying where assets moved on a public ledger.
- Freezing or blocking: preventing a service provider from processing a transaction or account.
- Recovery: returning control of the assets to the victim.
Funds can remain visible on-chain while being practically unrecoverable. A blacklisted address may make liquidation more difficult without returning the assets. Similarly, movement through several wallets does not prove that the money has been cashed out.
Bybit launched a recovery bounty offering up to 10% of recovered funds and published information about suspicious addresses through its LazarusBounty program. The exchange also worked with industry participants to identify and disrupt parts of the money trail. Those measures should not be described as proof that the entire amount was recovered.
See Bybit’s recovery-bounty announcement, LazarusBounty guide and suspicious-wallet API announcement.
Did Bybit remain solvent?
Bybit said it remained solvent, that customer assets were backed one-to-one and that withdrawals continued normally after the incident.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #4
- EAL5+ CERTIFIED SECURE ELEMENT + FINGERPRINT PROTECTION — Your private keys stay encrypted offline on a certified EAL5+ chip, the same security tier used in EMV bank cards. Built by DCENT, securing crypto since 2018. Fingerprint authentication adds a second layer no PIN-only wallet can match.
- 10,000+ ASSETS NATIVE ON 100+ BLOCKCHAINS — Hold Bitcoin, Ethereum, XRP, Solana, Cardano, popular stablecoins (USDT, USDC), and NFTs in one wallet. No third-party apps, no fragmented setup — every supported asset works straight out of the box.
- TAP-TO-SIGN MOBILE EXPERIENCE — Pair your wallet with the DCENT mobile app over Bluetooth. Manage tokens, review transactions, and access in-app swap features directly from your phone — no cables, no desktop required.
- WEB3 & dAPP ACCESS VIA METAMASK — Connect to MetaMask and other browser extension wallets to manage NFTs, claim airdrops, and access dApps. A large screen and intuitive 4-button interface keep every transaction clearly visible before you sign.
- SEAMLESS FIRMWARE UPDATES & 30-DAY MONEY-BACK GUARANTEE — Apply security updates without resetting your wallet or migrating funds. Backed by Amazon's 30-day money-back guarantee — your purchase is risk-free.
Bybit also announced that a Hacken proof-of-reserves review found 1:1 coverage for in-scope customer assets within 72 hours. That is a meaningful operational response, but it should not be confused with a complete audit of the company’s finances, liabilities, internal controls or future solvency.
Proof of reserves generally addresses specified assets and liabilities at a particular point or within a defined review scope. It does not prove that an exchange cannot be hacked, that every risk has been identified or that the platform will remain solvent under all future conditions.
The exchange’s statements and the Hacken review are documented in Bybit’s timeline and its proof-of-reserves announcement.
Why North Korea targets cryptocurrency
North Korea-linked theft operations have repeatedly targeted crypto businesses because digital assets combine several attractive characteristics for state-backed cybercriminals:
- global transfers without traditional banking intermediaries;
- rapid movement across borders and networks;
- pseudonymous wallet addresses rather than names on every transaction;
- large pools of value concentrated at exchanges and custodians; and
- uneven monitoring, freezing and enforcement across jurisdictions.
Blockchain transactions are not invisible. They are often permanently recorded and can be analyzed years later. The challenge is connecting addresses to people, preventing movement through multiple services and obtaining legal control of assets before they are converted or dispersed.
Chainalysis has reported that DPRK-linked actors had already stolen hundreds of millions of dollars across numerous incidents before the Bybit attack, and its 2026 reporting continued to identify North Korea as a major driver of crypto theft. That broader pattern explains why the Bybit operation was treated as more than an isolated exchange breach.
It is also important not to claim that the Bybit funds were individually traced into a specific weapons program unless an authoritative source establishes that connection. U.S. officials have made broader allegations about North Korean cyber-theft proceeds, but that is different from proving the final use of every dollar stolen from Bybit.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What exchanges and custodians should change
The incident shows that custody security is an operational discipline, not merely a choice between “hot” and “cold” wallets.
1. Independently decode every high-value transaction
Signers should not rely on a single web page to explain what they are approving. Transaction data, contract addresses, function calls and expected state changes should be checked through a separate trusted system.
Best Value
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
2. Use out-of-band confirmation
A transfer request should be confirmed through a communication channel separate from the signing interface. The confirmation should include the exact destination, amount, contract and purpose—not only a friendly description such as “move funds to warm storage.”
3. Separate duties and environments
Signers should use restricted, hardened devices and browser environments. Administrative privileges, wallet configuration and transaction approval should be separated so that one compromised workstation or session cannot silently change the process.
4. Monitor wallet-logic changes
Organizations should alert on changes to owners, thresholds, modules, delegates and other smart-contract controls. A transaction that changes how the wallet operates deserves a higher approval threshold than a routine transfer.
5. Add policy controls for large transfers
Allowlisted destinations, transaction limits, time delays and human escalation procedures can create opportunities to detect an abnormal approval before settlement. These controls add friction, but high-value custody requires accepting some friction in exchange for review time.
6. Plan for the aftermath
Custodians need tested incident-response plans, liquidity arrangements, chain-monitoring partnerships and procedures for notifying customers and service providers. A reserve backstop can help an exchange continue withdrawals, but it cannot undo the theft or replace weak authorization controls.
What individual crypto users should learn
The Bybit incident affected an exchange wallet, but its lessons also apply to personal custody.
- Do not treat proof of reserves as proof of security. It can show asset coverage under a defined scope without proving that the platform’s systems are immune to attack.
- Limit exchange balances when practical. Keeping only the amount needed for trading or near-term activity reduces exposure to exchange-level custody failures, although self-custody introduces its own risks.
- Use withdrawal controls where available. Address allowlists and withdrawal confirmations can reduce the chance of an unauthorized destination being used.
- Read signing prompts carefully. Do not approve a transaction merely because a familiar site or support representative says it is routine.
- Beware of phishing and fake support accounts. Never disclose seed phrases, private keys, backup codes or remote-access credentials.
- Understand the trade-off of self-custody. A hardware wallet or multisignature arrangement can reduce exchange-counterparty risk, but phishing, malicious signing prompts, lost credentials and poor backups become the user’s responsibility.
No single wallet type eliminates risk. The relevant question is whether the entire process—from request to signing to monitoring and recovery—has independent checks.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What remains uncertain
As of August 18, 2026, several distinctions remain important:
- The FBI has publicly attributed the theft to the DPRK, while the exact individual operators and internal command structure are not public.
- Investigators strongly associated the attack with Lazarus, but threat-actor names vary across intelligence organizations.
- The evidence supports a compromised signing workflow, but public accounts differ over the precise technical boundary between Safe’s interface or delivery environment, signer systems and the Safe codebase.
- On-chain movement can be tracked, but tracing does not establish that all assets were frozen, converted or recovered.
- Bybit’s reserve statements and the Hacken review describe coverage within a defined scope; they are not a guarantee of complete corporate financial health.
The broader significance
The Bybit heist exposed a contradiction at the heart of modern crypto custody: the strongest cryptographic asset can still be lost when humans approve the wrong smart-contract action.
It demonstrated the scale of North Korea-linked crypto theft, the importance of transaction-level monitoring and the limits of relying on labels such as “cold storage” or “multisignature” without examining the process around them.
For exchanges, the lesson is to secure the signing ceremony, not just the keys. For individual users, it is to distinguish solvency evidence from security evidence and to treat every signing prompt as a financial authorization—not as a routine click.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
