FBI Issues Alert About North Korean Hackers in Relation to $1.5 Billion Bybit Hack

The Federal Bureau of Investigation posted a new alert in relation to the Bybit hack. In the alert, North Korea has been fingered as the mastermind behind a staggering $1.5 billion heist targeting Bybit, a major cryptocurrency exchange. The theft, which took place around February 21, 2025, is being dubbed “TraderTraitor” by the FBI, a name that underscores the cunning and speed of this malicious cyber operation. This isn’t just a random hack; it’s a calculated move by state-sponsored actors who are already laundering the stolen virtual assets at breakneck pace, converting them into Bitcoin and scattering them across thousands of blockchain addresses.

The scale of this breach is astounding. Bybit, a platform trusted by millions, found itself in the crosshairs of North Korean hackers who exploited vulnerabilities with surgical precision. The FBI’s public service announcement didn’t mince words, pointing to a sophisticated operation that’s already shifting the stolen funds through multiple virtual currencies and blockchains. Private sector players, from blockchain analytics firms to decentralized finance services, are now being urged to step up and block transactions linked to this theft. The agency even provided a list of Ethereum addresses tied to the hackers, a rare move that signals just how seriously they’re taking this threat.

Stemming the Tide of North Korea’s Cyber Theft

The FBI isn’t just sounding the alarm; they’re calling for action. Companies operating in the digital asset space, including exchanges, bridge providers, and node operators, have a critical role to play according to the FBI. By identifying and freezing transactions tied to the TraderTraitor addresses, these entities can slow the hackers’ ability to cash out. The list of Ethereum wallets provided by the FBI is extensive. These accounts either hold stolen assets or are closely linked to the North Korean operatives orchestrating the scheme, says the FBI.

This isn’t the first time North Korea has flexed its muscles in the crypto space. The TraderTraitor operation builds on a playbook, with groups like the infamous Lazarus crew, who have hacked and stolen $5 billion in crypto over the years. Past attacks have seen them deploy trojanized apps and spearphishing campaigns to infiltrate blockchain companies, a tactic that’s evolved into the rapid-fire asset grabs we’re witnessing now.