In one of the largest cryptocurrency heists in history, hackers linked to the North Korean regime have successfully converted at least $300 million (around £232m) of their $1.5 billion (around £1.2bn) haul into untraceable funds.

The notorious Lazarus Group, believed to be operating on behalf of North Korea, stole the digital tokens in a sophisticated hack targeting crypto exchange ByBit two weeks ago.

Since then, authorities and crypto investigators have been locked in a race to block the hackers from laundering the stolen funds, which are suspected to be funneled into the regime’s military and nuclear programmes.

The Lazarus Group, which has been accused of carrying out numerous high-profile cyber-attacks over the past decade, executed the heist by hacking one of ByBit’s suppliers on February 21.

The attackers secretly altered the digital wallet address to which 401,000 Ethereum coins were being sent. ByBit, unaware of the breach, transferred the funds to the hackers’ wallet instead of its own. The stolen cryptocurrency, valued at approximately $1.5 billion, represents one of the largest thefts in the history of digital assets.

Despite efforts to track and recover the stolen funds, experts say the hackers are working around the clock to launder the cryptocurrency into cash. Dr. Tom Robinson, co-founder of blockchain analytics firm Elliptic, described the Lazarus Group as “extremely sophisticated” in their methods, when he spoke to the BBC.

“Every minute matters for the hackers who are trying to confuse the money trail.”

“I imagine they have an entire room of people doing this using automated tools and years of experience. We can also see from their activity that they only take a few hours break each day, possibly working in shifts to get the crypto turned into cash.”

It is thought that around 20% of the stolen funds have already “gone dark,” meaning they are unlikely to ever be recovered. This is a significant blow to efforts to reclaim the assets, as North Korea is widely regarded as one of the most skilled operators in the world of crypto laundering. The country’s closed economy, where most cash flows are controlled by the government, further complicates tracking efforts.

Recommended reading

• How Much Was Lost to Crypto Phishing Scams in 2024?
• Scotcoin Cryptocurrency to Make Market Debut
• Crypto Trading Platform Offers Over £1.5M for Bug Bounty

ByBit CEO Ben Zhou – who has been very active on X in updating users on progress – has assured customers that their funds remain safe, and the company has replenished the stolen cryptocurrency through loans from investors. However, Zhou has declared that ByBit is now “waging war on Lazarus.”

Join us on war against Lazarus – https://t.co/6DnaH1WTId
Industry first bounty site that shows aggregated full transparency on the sanctioned Lazarus money laundering activities. V1 includes:
– Becoming a bounty hunter by connecting your wallet and help tracing the fund, when…

— Ben Zhou (@benbybit) February 25, 2025

The exchange has launched a bounty programme, offering rewards to individuals who help identify and block the stolen funds. So far, 20 people have shared more than $4 million in rewards for successfully tracing $40 million of the stolen cryptocurrency and alerting crypto firms to freeze the transactions.