Youtube
Data Breach

The $1.5 Billion Bybit Cryptocurrency Heist and North Korean Hackers

North Korean TraderTraitor Hackers Behind $1.5B Bybit Crypto Heist
By Updated:196 Comments6 Mins Read
Bybit $1.5 billion crypto heist linked to Safe{Wallet} breach by North Korean hackers

The fallout from the $1.5 billion Bybit cryptocurrency heist is becoming clearer, and it’s worse than initially feared. Safe{Wallet}, a platform offering secure multi-signature services for Web3 assets, has now confirmed that the attack was not only state-sponsored but also executed with surgical precision.

The culprit? A North Korea-linked hacking group known as TraderTraitor — also tracked as Jade Sleet, PUKCHONG, and UNC4899. This group has been tied to multiple previous crypto-focused breaches and is now being held responsible for one of the largest digital heists in history.

How the Attack Unfolded: From Docker to Developer

A Social Engineering Trap

According to Safe{Wallet}, the hackers tricked a developer into downloading a Trojanized Docker project disguised as a stock investment simulator. The infected file, named MC-Based-Stock-Invest-Simulator-main, was downloaded on February 4, 2025, from a site registered just two days earlier — a key indicator of a tailored attack.

This wasn’t random malware. It was specifically crafted to target the developer’s macOS system, compromise their credentials, and embed backdoors for remote access.

Targeting Developer1: A High-Privilege Victim

The victim, identified as Developer1, was one of the few with elevated privileges on the team — someone whose role granted broad AWS access. That made them a perfect target for gaining control over key systems.

After breaching the machine, the hackers used the stolen AWS session tokens to bypass multi-factor authentication (MFA). This allowed them to act as if they were the developer, carrying out malicious activity during working hours to avoid raising alarms.

From AWS Access to $1.5 Billion Gone

Moving Quietly Inside the Cloud

Once inside the AWS environment, the attackers:

  • Conducted cloud reconnaissance
  • Identified digital assets and access points
  • Hijacked active user sessions
  • Coordinated malicious activity with the developer’s real schedule

To avoid being caught, they wiped traces of the malware, deleted bash history logs, and used obfuscation tactics like routing through ExpressVPN IPs. Their user agent string (distrib#kali.2024) even pointed to the use of Kali Linux, a toolset widely used by penetration testers and cyber attackers alike.

JavaScript Injection on Safe{Wallet}

The hackers weren’t done. They injected malicious JavaScript into the Safe{Wallet} website itself between February 19 and 21, potentially compromising even more users during that window.

They also used the Mythic framework, an open-source toolkit designed for red team operations — further demonstrating how professional and adaptable this group is.

Bybit’s Response and the Aftermath

Assets Tracked, Some Frozen

Bybit CEO Ben Zhou confirmed the staggering scale of the breach and provided a breakdown of the stolen assets:

  • 77% of funds still traceable
  • 20% have disappeared (“gone dark”)
  • 3% have been frozen with help from industry partners

In total, 417,348 ETH (around 83% of the haul) has already been converted into bitcoin, then split across nearly 7,000 wallets, making recovery complex and slow.

Zhou credited 11 organizations, including Mantle, Paraswap, and blockchain investigator ZachXBT, for their rapid assistance in freezing stolen assets.

TraderTraitor: North Korea’s Crypto Crime Machine

A Familiar Tactic with New Wrinkles

The attack fits the pattern of TraderTraitor’s earlier campaigns. These hackers have a well-documented history of targeting developers in the crypto space, often using:

  • Fake job offers
  • Telegram chats with “tech collaborators”
  • Booby-trapped projects and shared tools

Their tool of choice for persistence in this attack was PLOTTWIST, a custom backdoor malware that enables remote control of infected machines.

While the exact infection vector this time remains unclear, Safe{Wallet} noted that signs point to a social engineering playbook—starting with that fake Docker project and ending with an empty audit trail.

Web3 Heists Surge: $1.6B Lost in Just Two Months

2025 Is Already a Record Year

With this incident, crypto theft in 2025 has already hit $1.6 billion — just two months into the year. That’s eight times more than the total for the same period in 2024.

According to blockchain security firm Immunefi, the spike reflects:

  • Increased sophistication of threat actors
  • Inadequate safeguards in some Web3 protocols
  • Poor transaction verification flows

The attack proves that multi-signature wallets, while more secure than basic wallets, are not invincible, especially when endpoint security is weak or when developers are manipulated.

Safe{Wallet} Calls for Industry-Wide Action

It’s Not Just a User Problem

Following the attack, Safe{Wallet} released a sobering statement:

“Verifying that the transaction you are signing will result in the intended outcome remains one of the biggest security challenges in Web3. And this is not just a user or education problem — it is an industry-wide issue.”

The platform is now working closely with Google Cloud’s Mandiant team to fully understand the breach, prevent future occurrences, and share its findings with the wider Web3 community.

How This Attack Highlights Critical Web3 Flaws

Security Weak Spots Exposed

This attack lays bare several ongoing issues in the crypto and DeFi space:

  • Session hijacking still bypasses MFA in many cloud environments
  • Developer endpoints remain vulnerable to social engineering
  • Widespread trust in “helpful” open-source projects leads to easy malware entry
  • Transaction previews and confirmations are still confusing to many users
  • Even “secure” wallets are only as safe as the machines they run on

FAQs

Who carried out the Bybit $1.5 billion heist?
A North Korean hacking group known as TraderTraitor, also referred to as Jade Sleet or UNC4899.

How did the hackers gain access?
They tricked a developer into downloading a malicious Docker project, compromised their macOS system, and hijacked active AWS sessions to move within the cloud.

Was multi-factor authentication bypassed?
Yes. By using stolen AWS session tokens, the hackers avoided MFA and acted as if they were the authorized user.

What tools were used in the attack?
Key tools included the PLOTTWIST malware, the Mythic framework, ExpressVPN, and JavaScript injection. The attackers also wiped logs to hinder investigation.

How much of the stolen crypto has been recovered?
Roughly 3% of the funds have been frozen, while 77% remains traceable. About 20% is currently unaccounted for.

What does this mean for crypto security in 2025?
This attack signals a new level of sophistication and volume in crypto crime. It shows that the industry must improve endpoint security, session protection, and transaction validation.

Author

Share.

Related Posts

196 Comments

  42. Binance开户 on

    Thank you for your sharing. I am worried that I lack creative ideas. It is your article that makes me full of hope. Thank you. But, I have a question, can you help me?

  44. tongits on

    Tongits Online Real Money: Easy Login, Register & App Download for the Best Casino Slots in the Philippines. Experience Tongits online real money! Enjoy easy Tongits login, fast Tongits register, and the Tongits app download for the best casino slots in the Philippines. Play and win big today! visit: tongits

  61. Binance注册 on

    Thank you for your sharing. I am worried that I lack creative ideas. It is your article that makes me full of hope. Thank you. But, I have a question, can you help me?

  63. Binance账户 on

    Thank you for your sharing. I am worried that I lack creative ideas. It is your article that makes me full of hope. Thank you. But, I have a question, can you help me?

  64. 注册 on

    Can you be more specific about the content of your article? After reading it, I still have some doubts. Hope you can help me.

  70. 615betwin on

    If you’re looking for a new place to play, 615betwin is worth checking out. They’ve got a solid selection and the site runs smoothly. Nothing too flashy, but gets the job done. See if you can win: 615betwin

  71. 68winapp on

    The 68winapp is surprisingly decent. Easy to download and install, and it’s pretty responsive. Great selection of games too, so definitely worth a look, especially if you prefer playing on your phone: 68winapp

  86. Binance on

    Thank you for your sharing. I am worried that I lack creative ideas. It is your article that makes me full of hope. Thank you. But, I have a question, can you help me?

  93. binance Registrera on

    Thank you for your sharing. I am worried that I lack creative ideas. It is your article that makes me full of hope. Thank you. But, I have a question, can you help me?

  95. Binance开户 on

    Thank you for your sharing. I am worried that I lack creative ideas. It is your article that makes me full of hope. Thank you. But, I have a question, can you help me?

  96. KaleSmurf on

    Honestly impressed by how much useful content sits in such a small post, and a stop at firstisnotequallast confirmed the rest of the site packs a similar punch, density without confusion is a hard balance to strike and this site has clearly cracked the code on it across many different topic areas covered.

  166. zoritoler imol on

    Hey! I know this is kind of off topic but I was wondering if you knew where I could locate a captcha plugin for my comment form? I’m using the same blog platform as yours and I’m having difficulty finding one? Thanks a lot!

  170. Riley paxton Chaudhary on

    The aftermath—both the frozen assets and the involvement of multiple cybersecurity tools indicates just how serious this breach is. As Mầm Non Đồng Nai residents know, ensuring one’s safety and security often involves being vigilant against all threats, not just those from our local neighborhood but also those from across the globe. Chaudhary Quietly

  171. Riley paxton penetration on

    Chọn Trường Mầm Non Sài Gòn đã nhận được thông tin chính xác và cập nhật từ các nhà chức trách về vụ hacker truy quét 1 tỷ USD của BitBycoin. Sự cố này không chỉ gây ra mất mát về tài sản mà còn là một cuộc tấn công lớn đối với ngành công nghiệp tiền điện tử nói chung. penetration deleted

  172. Riley paxton Ben on

    Wow! This article has really sparked my interest in cybersecurity and crypto-heists. It’s incredible how such massive theft can be orchestrated through social engineering and custom-built malware. The mention of “Sổ tay mần non” is a perfect way to describe that precise, surgical execution. It’s like the attackers were well-prepared and took every step necessary to avoid detection. Ben Billion

  173. Riley paxton out on

    Mầm non hà nội, nơi đây luôn được biết đến với vẻ đẹp hoang sơ và bình yên của cuộc sống dân dã. Trải qua nhiều năm phát triển, Hà Nội vẫn giữ được nét cổ kính mà không hề thay đổi, từ những con đường vắng người đến những vườn tre xanh mướt. out Web

  176. Riley paxton Billion on

    5 billion Bybit cryptocurrency heist orchestrated by North Korea-linked hackers. Mầm chòi Lá that this attack involved both state-sponsored and cybercriminal elements is a stark reminder of how global cybersecurity remains fragile, especially when it comes to blockchain technology. The surgical precision with which they targeted Developer1 highlights the sophistication of modern hackers, who now have more tools than ever before to breach even the most secure systems. Billion target

  178. Riley paxton tricked on

    I couldn’t believe how skilled these North Korea-linked hackers were in carrying out such a heist with surgical precision. It’s shocking to think that even major companies are not immune to cyber attacks from these talented cyber criminals. As someone who recently read about the data breach at Việt Nam Preschool Resourcces, I can appreciate just how dangerous this kind of attack really is. tricked compromising

  185. binance kod on

    I don’t think the title of your article matches the content lol. Just kidding, mainly because I had some doubts after reading the article.

  191. binance konto on

    Thank you for your sharing. I am worried that I lack creative ideas. It is your article that makes me full of hope. Thank you. But, I have a question, can you help me?

  193. arderbor elnot on

    An fascinating dialogue is worth comment. I believe that you should write extra on this topic, it won’t be a taboo topic but usually people are not enough to speak on such topics. To the next. Cheers

  196. zimerovertover on

    Fantastic blog! Do you have any tips for aspiring writers? I’m hoping to start my own blog soon but I’m a little lost on everything. Would you suggest starting with a free platform like WordPress or go for a paid option? There are so many choices out there that I’m completely confused .. Any tips? Thank you!

Leave A Reply

Home

About Me

© 2026 ThemeSphere. Designed by ThemeSphere.
Exit mobile version