The FBI attributes the $1,500 million theft from Bybit to North Korea

What happened

On 27 February 2025 the FBI attributed the theft of approximately 1.5 billion dollars in virtual assets from the cryptocurrency exchange Bybit to actors linked to North Korea. The agency noted that the funds were being moved rapidly through multiple addresses and asset types.

The group named by the FBI, known as TraderTraitor, has been linked by US authorities to previous operations against cryptocurrency platforms aimed at generating revenue for the North Korean regime.

What it means for a mid-sized business

Although the case involves a crypto-asset platform, the technique and scale reveal the level of sophistication state-backed groups can bring against critical financial operations, relevant to any business handling payments, treasury or digital assets.

The rapid movement of funds across multiple destinations, designed to hinder tracing, underlines the importance of detecting unusual transactions as they happen, not days later.

What to review

Measures applicable to any organisation with sensitive financial operations:

• Segregation of duties in authorising high-value transfers.
• Real-time monitoring of unusual movements in critical accounts.
• Additional validation for transactions above certain thresholds.
• Review of privileged access to payment systems and digital signatures.

Frequently Asked Questions

How was the attack attributed to North Korea?

The FBI named the group known as TraderTraitor, linked by US authorities to previous operations against cryptocurrency platforms.

Were the stolen funds recovered?

The FBI stated the funds were being moved rapidly across multiple addresses, which makes recovery difficult once they leave the platform.

Why does this matter to businesses that don't deal in cryptocurrency?

The case illustrates the sophistication of state-backed attackers and the importance of segregation and monitoring controls in any critical financial operation.