FOLLOW US

The Bybit cryptocurrency exchange suffered a massive security breach on Friday, February 21, when hackers stole an estimated $1.5 billion worth of cryptocurrency. The cybercriminals utilized TraderTraitor applications to gain unauthorized access to the exchange’s systems. marking another high-profile attack linked to the reclusive DPRK regime’s hacking operations.

The agency claimed the theft of the virtual assets from the cryptocurrency exchange utilized a specific cluster it tracks as TraderTraitor, also referred to as Jade Sleet, Slow Pisces, and UNC4899.

This marks another high-profile attack linked to the reclusive DPRK regime’s hacking operations.

 According to a statement from the FBI on Wednesday, February 26, the attack has been attributed to state-sponsored actors in the Democratic People’s Republic of Korea (DPRK), commonly known as North Korea.

When the FBI linked the record-breaking hack to North Korean threat actors, Bybit CEO Ben Zhou declared a "war against Lazarus."

FBI Identifies TraderTraitor as the Attack Vector

In an official advisory, the FBI outlined how North Korean actors carried out the attack, stating:

“TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets to Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains. It is expected these assets will be further laundered and eventually converted to fiat currency.”

The federal agency has identified more than 50 Ethereum addresses connected to the attack and is urging the private sector to block transactions associated with these addresses. The hackers are reportedly attempting to launder the stolen funds and convert them into legal tender.

North Korea’s Ongoing Crypto Attacks

The U.S. government has long monitored North Korean cyber activities, particularly their focus on blockchain and cryptocurrency-related businesses. A Cybersecurity Advisory issued in April 2022 warned:

“The U.S. government has observed North Korean cyber actors targeting a variety of organizations in the blockchain technology and cryptocurrency industry, including cryptocurrency exchanges, decentralized finance (DeFi) protocols, play-to-earn cryptocurrency video games, cryptocurrency trading companies, venture capital funds investing in cryptocurrency, and individual holders of large amounts of cryptocurrency or valuable non-fungible tokens (NFTs).”

The advisory also noted that North Korean hackers use social engineering tactics on various communication platforms to "trick victims into downloading trojanized cryptocurrency applications on both Windows and macOS operating systems."