113: Lazarus Group: Hacking for the Regime

How North Korea’s Elite Hackers Stole $1.5 Billion

In a staggering breach on February 21, 2025, Dubai-based cryptocurrency exchange Bybit fell victim to a sophisticated cyberattack, resulting in the theft of approximately $1.5 billion worth of Ethereum. This incident not only underscores the vulnerabilities within the crypto ecosystem but also highlights the persistent threat posed by state-sponsored hacking groups, notably North Korea's Lazarus Group.

What is Ethereum and Why is it Valuable?

Ethereum is a decentralized blockchain platform that enables smart contracts and decentralized applications (DApps) to be built and operated without any central authority. Unlike Bitcoin, which primarily serves as a digital currency, Ethereum's value comes from its ability to facilitate complex financial and legal transactions through programmable code. Ether (ETH), the platform's native cryptocurrency, is used as "gas" to power these transactions, making it an essential part of the blockchain economy. Its widespread adoption and versatility have made it one of the most valuable cryptocurrencies, making large holdings an attractive target for cybercriminals.

The attack on Bybit occurred during a routine transfer from the exchange's cold wallet—a secure offline storage—to a warm wallet, which is connected to online systems for transactional purposes. Hackers infiltrated this process, exploiting vulnerabilities in Bybit's security protocols. They manipulated the transaction process, gaining unauthorized control over the cold wallet and transferring over 400,000 ETH to an unidentified address. Bybit's CEO, Ben Zhou, reassured clients of the exchange's solvency and the security of their assets, despite processing over 350,000 withdrawal requests following the breach.

The Lazarus Group and the Bybit Hack

The Lazarus Group, a North Korean state-sponsored hacking collective, is widely suspected to be behind the Bybit hack. Blockchain forensic analysis has identified similarities between this attack and previous breaches attributed to Lazarus, including the movement of stolen funds through known laundering channels. Additionally, North Korean cyber operations have increasingly focused on cryptocurrency heists, recognizing them as an effective means of bypassing international sanctions and funding the regime's weapons programs. (Georgetown Journal of International Affairs)

North Korea's venture into cybercrime, particularly cryptocurrency theft, is a strategic response to international sanctions and economic isolation. The regime has cultivated a cadre of skilled hackers, often operating under groups like the Lazarus Group, to generate revenue through illicit cyber activities. These funds are believed to support the nation's nuclear and missile programs, circumventing traditional financial restrictions.

Emerging around 2009, the Lazarus Group has been linked to numerous high-profile cyberattacks. Their operations range from the infamous 2014 Sony Pictures hack to large-scale cryptocurrency heists. Notable incidents include:

• 2016 Bangladesh Bank Robbery – Attempted theft of nearly $1 billion via the SWIFT banking network.

• 2022 Ronin Network Breach – Stole approximately $625 million in cryptocurrency.

• 2023 Atomic Wallet Attack – Drained more than $100 million from user wallets.

Their tactics often involve social engineering, such as spear-phishing campaigns, to infiltrate target systems.

Beyond acknowledging the growing role of outfits like the Lazarus Group, are we seeing a new form of state-based espionage that is not limited to North Korea? From a national security perspective, let alone revenue, shouldn’t all governments develop similar capabilities? At least from a defensive perspective?

For a deeper dive into the operations of the Lazarus Group and their impact on global cybersecurity: