Lazarus launders $1.5B from major exchange

TLDR

Lazarus Group has started laundering about $1.5 billion in stolen crypto traced to a major Bybit exchange hack, according to law enforcement and blockchain analytics reports.

1. A February 2025 Bybit breach is attributed to North Koreas Lazarus Group, with roughly 400,000 ETH, valued near $1.5 billion, now being laundered across networks.
2. Funds are reportedly being mixed with other DPRK-linked hacks and routed through bridges and services that make tracing harder, creating sanctions and compliance risk for any platform that touches them.
3. The key things to watch are address blacklists, law enforcement seizures, and whether major exchanges tighten screening enough to avoid secondary exposure to these tainted flows.

Deep Dive

1. What Happened And Who Was Hit

Reports describe a large-scale hack of Bybit in 2025, with about 400,000 ETH stolen, worth roughly $1.5 billion at the time, ranking among the biggest crypto thefts to date.

Blockchain forensics and an FBI advisory known as TraderTraitor have linked the incident to North Koreas state-backed Lazarus Group, and investigators say those stolen assets are now being actively laundered through crypto infrastructure.

Bybits CEO has said the exchange holds more than enough assets to cover the loss and that customer funds remain fully backed, framing this as a security and compliance incident rather than a solvency crisis.

2. How The Laundering Works And Why It Matters

Analytics firm Elliptic and other investigators report that Lazarus is commingling Bybits stolen ETH with proceeds from prior DPRK-linked hacks, using techniques consistent with earlier operations, which complicates attribution and recovery.

The flows reportedly move across multiple chains, using cross-chain bridges, mixers, and over the counter style services that specialize in obfuscating origins, increasing the chance that tainted coins land on otherwise legitimate venues.

3. What To Watch Next

Historically, DPRK-linked thefts are laundered within about 45 days, so the most intense on chain activity tends to cluster in the weeks after a major hack.

Authorities have already urged virtual asset service providers to block transactions from identified Lazarus addresses, and further advisories or seizures would signal that specific clusters of wallets have been tagged as high risk.

On the industry side, more stringent address screening, slower approvals for large withdrawals, and tighter listing and onboarding checks at major exchanges are likely if regulators view this episode as a sanctions compliance failure, not just a hack.

Conclusion

Lazarus turning a roughly $1.5 billion Bybit exploit into active laundering flows is less about immediate price impact and more about regulatory and compliance pressure on the entire crypto ecosystem. The more thoroughly exchanges and DeFi teams detect and isolate these funds, the lower the risk that ordinary users are caught in freezes or sanctions fallout as this case unfolds.