North Korean Hackers Steal $230 Million in Cryptocurrency Exchange Heist
The Lazarus Group, a notorious North Korean hacking collective, has been linked to a $230 million cryptocurrency theft from a major exchange.
North Korean state-sponsored hackers have stolen approximately $230 million in cryptocurrency from ByBit, one of the world's largest cryptocurrency exchanges, in what security researchers are calling the largest crypto heist of 2026.
Blockchain analysis firms Chainalysis and Elliptic have independently attributed the attack to the Lazarus Group, a hacking collective linked to North Korea's Reconnaissance General Bureau.
"The attack vector and laundering patterns are consistent with previous Lazarus operations," said Tom Robinson, co-founder of Elliptic. "We've tracked the stolen funds through a complex series of mixers and cross-chain bridges designed to obscure their origin."
ByBit confirmed the breach in a statement, revealing that attackers compromised a hot wallet through a supply chain attack on a third-party library used in the exchange's trading infrastructure. The company stated it would cover all customer losses from its own reserves.
The theft brings North Korea's estimated cryptocurrency theft total to over $3 billion since 2017, according to United Nations reports. These stolen funds are believed to finance the country's nuclear weapons and ballistic missile programs.
"Cryptocurrency theft has become a critical revenue stream for the DPRK regime," said Dr. Katherine Schwartz, a sanctions expert at the Foundation for Defense of Democracies. "It allows them to circumvent international sanctions while funding prohibited weapons programs."
The FBI and Treasury Department's Office of Foreign Assets Control (OFAC) have issued alerts warning exchanges and financial institutions to screen for addresses associated with the stolen funds.