ReportedattributionStatement 15
Three analytics firms linked the attack to North Korean state actors.
Three analytics firms link the attack to North Korean state actors.
Statements
Each statement is one attributed line with a verbatim quote from a stored copy of the source. Only approved statements are shown.
Official means the party said it, not that it is true.
- Verified on-chain. Reproduced by us from raw chain data kept in our own storage. The method is shown.
- Official. Stated by the party concerned (an exchange, an agency, a token issuer or similar), attributed to them. Official means the party said it, not that it is true.
- Reported. Stated by news media or an analytics firm, attributed to them.
- Disputed. Credible sources conflict. The statement links the sources that disagree.
- Debunked. Contradicted by primary evidence, which is linked.
- Theory. Speculation, attributed to whoever proposed it, shown with the evidence for and against.
443 statements.
ReportedfreezeStatement 13
Hacken reports that between $2.7B and $2.84B was frozen within hours of the attack, mostly stablecoins.
Between $2.7B and $2.84B was frozen within hours , almost all of it stablecoins that issuers such as Tether and Circle can block.
ReportedamountStatement 12
Hacken said that estimates of the loss from the hack range from about $6.3B to $6.43B, making it the largest crypto theft on record.
Estimates of the loss run from about $6.3B to $6.36B and $6.43B , which makes this the largest crypto theft on record.
ReportedcomparisonStatement 801
TRM said in its 26 February 2025 Bybit post that blockchain intelligence confirmed North Korean hackers were responsible, citing clear overlaps between the wallets used and those associated with past North Korean thefts.
Through blockchain intelligence, TRM Labs confirmed that North Korean hackers were responsible for the breach, linking it to previous state-sponsored crypto heists. The evidence revealed clear overlaps between the wallets used in this operation and those associated with past North Korean thefts.
OfficialcomparisonStatement 793
The FBI said in its Bybit notice that the Ethereum addresses it lists are holding or have held assets from the theft and are operated by or closely connected to North Korean TraderTraitor actors.
The following Ethereum addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:
OfficialcomparisonStatement 792
The FBI said in its Bybit notice that TraderTraitor actors had converted some of the stolen assets to Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains, and that further laundering was expected.
TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets to Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains. It is expected these assets will be further laundered and eventually converted to fiat currency.
OfficialcomparisonStatement 791
The FBI said in its 26 February 2025 Bybit notice that it refers to this North Korean malicious cyber activity as TraderTraitor.
FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor
OfficialcomparisonStatement 790
The FBI said in a public service announcement dated 26 February 2025 that North Korea was responsible for the theft of approximately $1.5 billion in virtual assets from the exchange Bybit on or about 21 February 2025.
The Federal Bureau of Investigation (FBI) is releasing this PSA to advise the Democratic People's Republic of Korea (North Korea) was responsible for the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange, Bybit, on or about February 21, 2025.
ReportedcomparisonStatement 803
Chainalysis said the Bybit attack highlights a common DPRK playbook of social engineering attacks and intricate laundering methods.
This attack highlights a common playbook used by the DPRK: orchestrating social engineering attacks and employing intricate laundering methods in an attempt to move stolen funds undetected.
ReportedcomparisonStatement 802
Chainalysis said Bybit funds consolidated in addresses holding funds from other known DPRK-linked attacks, which it called further evidence that nation state actors were behind the Bybit incident.
Funds from the Bybit exploit have also consolidated in addresses holding funds from other known DPRK-linked attacks, providing further evidence that the nation state actors are behind this latest incident.
ReportedcomparisonStatement 800
Elliptic said that within two hours of the Bybit theft the stolen funds were sent to 50 different wallets, each holding approximately 10,000 ETH.
Within two hours of the theft, the stolen funds were sent to 50 different wallets, each holding approximately 10,000 ETH.
ReportedcomparisonStatement 799
Elliptic said it attributed the Bybit theft to North Korea based on various factors, including its analysis of the laundering of the stolen cryptoassets.
Elliptic has attributed the Bybit theft to North Korea, based on various factors, including our analysis of the laundering of the stolen cryptoassets.
ReportedcomparisonStatement 804
Halborn said the root of the Bybit transaction was a malicious transaction designed to modify the smart contract logic of the exchange's multi-signature wallet.
The root of the Bybit transaction was a malicious transaction designed to modify the smart contract logic of the exchange’s multi-signature wallet.
OfficialcomparisonStatement 798
The FBI, DC3 and Japan's National Police Agency said the actors likely used their access in late May 2024 to manipulate a legitimate transaction request by a DMM employee, resulting in the loss of 4,502.9 BTC worth $308 million at the time.
In late-May 2024, the actors likely used this access to manipulate a legitimate transaction request by a DMM employee, resulting in the loss of 4,502.9 BTC, worth $308 million at the time of the attack.
OfficialcomparisonStatement 797
The FBI said that after mid-May 2024 TraderTraitor actors exploited session cookie information to impersonate the compromised employee.
After mid-May 2024, TraderTraitor actors exploited session cookie information to impersonate the compromised employee
OfficialcomparisonStatement 796
The FBI, DC3 and Japan's National Police Agency said a North Korean cyber actor posing as a LinkedIn recruiter contacted an employee of Ginco, a Japan-based wallet software company, in late March 2024.
In late March 2024, a North Korean cyber actor, masquerading as a recruiter on LinkedIn, contacted an employee at Ginco, a Japan-based enterprise cryptocurrency wallet software company.
OfficialcomparisonStatement 795
The FBI, DC3 and Japan's National Police Agency said in their DMM notice that TraderTraitor activity is often characterized by targeted social engineering directed at multiple employees of the same company simultaneously.
TraderTraitor activity is often characterized by targeted social engineering directed at multiple employees of the same company simultaneously.
OfficialcomparisonStatement 794
The FBI, the Department of Defense Cyber Crime Center and Japan's National Police Agency said on 23 December 2024 that the May 2024 theft of $308 million from DMM was by North Korean cyber actors and is affiliated with TraderTraitor threat activity.
The Federal Bureau of Investigation, Department of Defense Cyber Crime Center, and National Police Agency of Japan are alerting the public to the theft of cryptocurrency worth $308 million U.S. dollars from the Japan-based cryptocurrency company DMM by North Korean cyber actors in May 2024. The theft is affiliated with TraderTraitor threat activity, which is also tracked as Jade Sleet, UNC4899, and Slow Pisces.