DriversRecommendedOutdated drivers can make a good PC feel brokenScan driver issues before chasing fixes manually.Scan NowOctober DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsSlow PC?RecommendedPC slow today? Run a repair scan before it gets worseResolve common Windows issues and optimize system performance.Scan Now×
Skip to content
The Finance Base
The Money Desk · Blog
Re:

North Korea Was Behind the $1.5 Billion Bybit Crypto Heist, FBI Says

The FBI attributed Bybit’s February 2025 crypto theft to North Korea. The estimated loss was about $1.46 billion to $1.5 billion, depending on the source.
From TheFinanceBase Team3 min to read
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

About $1.46 billion in cryptocurrency was stolen from exchange Bybit on February 21, 2025, according to Elliptic. The FBI later attributed the theft to North Korea and put the amount at approximately $1.5 billion. The figures are rounded estimates of the assets’ value at the time of the theft, not their present-day value.

What happened at Bybit?

On February 21, 2025, attackers stole cryptocurrency from Bybit, a digital-asset exchange. Elliptic estimated the stolen assets at approximately $1.46 billion in a report published two days later. On February 26, the FBI said North Korea was responsible for stealing approximately $1.5 billion in virtual assets on or about February 21. The difference reflects the sources’ rounded estimates, not a separate incident. FBI / IC3 announcement; Elliptic report.

The loss was large enough to prompt immediate questions about Bybit’s ability to meet customer obligations. CEO Ben Zhou told the Associated Press, “We can cover the loss.” That statement concerned the exchange’s capacity to cover the loss; it was not a claim that the stolen cryptocurrency had been recovered. Associated Press report.

Who attributed the theft to North Korea?

Blockchain researchers and investigator ZachXBT publicly linked the operation to North Korean actors before the FBI made its announcement. Early reporting connected the actors to the Lazarus Group, but the source accounts do not establish that Lazarus and the FBI’s label refer to precisely the same operational unit in this incident. TechCrunch, February 24, 2025.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
#1 Best Overall
Sale
Ledger Nano X - Classic Crypto Wallet with Bluetooth
  • Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
  • Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
  • Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
  • Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
  • Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.

On February 26, the FBI publicly attributed the theft to North Korea and referred to the actors as TraderTraitor. That is the official U.S. attribution in the available sources. TechCrunch reported on February 24 that Bybit was still investigating attribution at that point, so the chronology matters: researcher allegations came first, followed by the FBI’s public statement. FBI / IC3 announcement; TechCrunch.

How did Elliptic trace the stolen funds?

Elliptic described a fast-moving laundering process rather than a single transfer to one destination. Its account said some stolen tokens were quickly exchanged for Ether, then funds were divided and moved among many wallets and services. Elliptic identified decentralized exchanges, cross-chain bridges, centralized exchanges and mixers in its tracing account. These are Elliptic’s findings and analysis, not a complete, independently settled ledger of every movement.

Rank #2
Sale
TANGEM Crypto Wallet Pack of 3 – Trusted Cold Storage Hardware Wallet
  • Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
  • Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
  • Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
  • Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
  • Trusted by 6 million users worldwide (4.9 App Store, 4.8 Google Play) - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets

Elliptic said 50 initial wallets received funds within two hours of the theft and were emptied over the next nine days. That is a dated snapshot of the tracing at the time, not a final accounting. The firm also reported that funds were being commingled with funds from earlier thefts attributed to North Korea. Its co-founder and chief scientist, Tom Robinson, told TechCrunch that “the laundering methods being used are very similar to those previously seen with DPRK.” Elliptic report, updated March 5, 2025; TechCrunch.

Elliptic explained that some token issuers can freeze tokens, while Ether and Bitcoin do not have a central issuer with the same ability to freeze an asset. The firm’s account therefore described swapping assets as one feature of the laundering pattern. This explanation concerns the tracing of this incident; it should not be read as a complete account of how the attackers initially gained access to Bybit.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
TANGEM Crypto Wallet Pack of 2 – Trusted Cold Storage Hardware Wallet
  • Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
  • Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
  • Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
  • Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
  • Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets

Was it the largest crypto theft?

Elliptic called the Bybit incident the largest crypto theft at the time, comparing it with the $611 million Poly Network theft in 2021. Elliptic noted that most of the Poly Network funds were later returned. The comparison is about reported cryptocurrency thefts; it does not establish a ranking across every category of theft. Elliptic report.

The exact headline figure depends on the source and how it rounds the estimate: Elliptic reported approximately $1.46 billion, while the FBI used approximately $1.5 billion. Both refer to the value associated with the theft in February 2025.

Rank #4
DCENT Hardware Wallet | Biometric Cold Storage, Bluetooth, Multi-Crypto
  • EAL5+ CERTIFIED SECURE ELEMENT + FINGERPRINT PROTECTION — Your private keys stay encrypted offline on a certified EAL5+ chip, the same security tier used in EMV bank cards. Built by DCENT, securing crypto since 2018. Fingerprint authentication adds a second layer no PIN-only wallet can match.
  • 10,000+ ASSETS NATIVE ON 100+ BLOCKCHAINS — Hold Bitcoin, Ethereum, XRP, Solana, Cardano, popular stablecoins (USDT, USDC), and NFTs in one wallet. No third-party apps, no fragmented setup — every supported asset works straight out of the box.
  • TAP-TO-SIGN MOBILE EXPERIENCE — Pair your wallet with the DCENT mobile app over Bluetooth. Manage tokens, review transactions, and access in-app swap features directly from your phone — no cables, no desktop required.
  • WEB3 & dAPP ACCESS VIA METAMASK — Connect to MetaMask and other browser extension wallets to manage NFTs, claim airdrops, and access dApps. A large screen and intuitive 4-button interface keep every transaction clearly visible before you sign.
  • SEAMLESS FIRMWARE UPDATES & 30-DAY MONEY-BACK GUARANTEE — Apply security updates without resetting your wallet or migrating funds. Backed by Amazon's 30-day money-back guarantee — your purchase is risk-free.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What the 2025 totals say about crypto theft

Chainalysis estimated that more than $3.4 billion in cryptocurrency was stolen from January through early December 2025, including $1.5 billion attributed to the Bybit theft. It separately estimated that North Korean hackers stole $2.02 billion in cryptocurrency during 2025, a 51% increase from its estimate for the previous year. These are Chainalysis estimates, not official government totals, and they describe the broader year rather than a final recovery ledger for Bybit. Chainalysis 2025 retrospective.

Quick Recap

Best Value
Trezor Safe 7 Crypto Hardware Wallet with Bluetooth for Android/iOS/Desktop
  • Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
  • Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
  • See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
  • Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
  • Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.

What is not established about the hack?

  • The precise initial compromise: The reviewed reporting does not establish a complete technical chain showing how the attackers first gained access. The Associated Press reported Bybit’s description of a manipulated routine Ethereum wallet transfer, but that alone does not prove a specific vulnerability or entry method. Associated Press.
  • A final recovery total: Elliptic described seizures connected to its alerts, but the cited sources do not provide a settled aggregate amount recovered or frozen. Its March 5, 2025 update and Chainalysis’s later annual estimates should not be treated as a current, complete recovery ledger. Elliptic; Chainalysis.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More post from the Money Desk

  1. The Money DeskBlogTheFinanceBase09 OCT 267 minMortgage Escrow FAQs: Taxes, Insurance, Shortages, and Refunds
  2. The Money DeskBlogTheFinanceBase09 OCT 265 minHow Mortgage Escrow Accounts Work and What Homeowners Pay For
  3. The Money DeskBlogTheFinanceBase09 OCT 265 minHow to Read a Stock Chart, Volume and Market-Cap Data
Recommended PC Tool
Recommended PC Tool
PC Slower Than It Used to Be?Free scan - under a minute
Outdated Drivers Are Slowing You DownFree scan - exact matches

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.