The $1.5B Bybit Hack & How OSINT Led to Its Attribution
Contents
The $1.5B Bybit Hack & How OSINT Led to Its Attribution
August 6, 2025
13 min read
On February 21st, 2025, Bybit got hit with the biggest crypto heist in history. The exchange, which ranks as the world’s second-largest cryptocurrency platform by trading volume, with over 60 million users worldwide, saw the Lazarus group steal over $1.4 billion in assets, including 401,347 ETH, directly from their cold wallet.
Founded in 2018 with a mission to redefine openness in the decentralized world through creating a simpler, accessible ecosystem for everyone, Bybit faced its biggest challenge yet. The attack was brutally simple: they tricked Bybit’s signers into approving what appeared to be legitimate transactions, but in fact were huge fund transfers to the attackers.
A decade of bulletproof security fell apart over a basic setup mistake that hackers exploited for their biggest payday.
This wasn’t their first rodeo. Lazarus APT grabbed around $660.5 million across 20 attacks in …
August 6, 2025
13 min read
On February 21st, 2025, Bybit got hit with the biggest crypto heist in history. The exchange, which ranks as the world’s second-largest cryptocurrency platform by trading volume, with over 60 million users worldwide, saw the Lazarus group steal over $1.4 billion in assets, including 401,347 ETH, directly from their cold wallet.
Founded in 2018 with a mission to redefine openness in the decentralized world through creating a simpler, accessible ecosystem for everyone, Bybit faced its biggest challenge yet. The attack was brutally simple: they tricked Bybit’s signers into approving what appeared to be legitimate transactions, but in fact were huge fund transfers to the attackers.
A decade of bulletproof security fell apart over a basic setup mistake that hackers exploited for their biggest payday.
This wasn’t their first rodeo. Lazarus APT grabbed around $660.5 million across 20 attacks in …
IoC
http://anglerstatic.com
http://trashcrease.com
http://replaydreary.com
https://github.com/mariaauijj
https://github.com/lauraengmp
http://eclairdomain.com
http://70.34.245.118
http://getstockprice.info
http://goingladies.com
http://gossipsnare.com
http://193.233.171.58
http://193.233.85.234
http://getstockprice.com
http://Anglerstatic.com
http://showmanroast.com
http://coreladao.com
http://cdn.clubinfo.io
https://github.com/patriciauiokv
131.226.2.43
213.252.232.171
193.233.171.58
131.226.2.120
178.128.77.132
51.38.145.49
37.120.247.180
193.233.85.234
70.34.245.118
88.119.175.208
23.236.169.233
c963e65b9ec39b11076f78990c31f29aaa80705c75312dafd1748479e3e94ed0
33d057af74779925c4b2e720a820387cb89f8f65
6262a3339842240aeebae4ebfe338dbc771aa0e2df8f5a1ebcd7f9b090bedfe3
93424aa87731bb9b1d8cc1f708d2ac9f3faf914f368a00494d87cba3e7719e8c
83c7678492d623fb98834f0fbcb2e7b7f5af8950
411374feedcfa560335f00c0fcfa0a3906fdcc33687e6f924dd78ebecc45cd00
15ec300a4895a86322f1a27dd9ba0b9f8297e65d
4a366130118d750715c2d35fdc07509cf943fcc988fa5e6d02211e3d5472796e
bdd077f651ebe7f7b3ce16fe5f2b025be2969516
96244d83dc15d36847c35209bbdc5bdde9bec3d8
a0495b9421b0e81479b5271a041c9f28fc555800
d555789b146256253cd4540da28dcff6e44f6e50
http://trashcrease.com
http://replaydreary.com
https://github.com/mariaauijj
https://github.com/lauraengmp
http://eclairdomain.com
http://70.34.245.118
http://getstockprice.info
http://goingladies.com
http://gossipsnare.com
http://193.233.171.58
http://193.233.85.234
http://getstockprice.com
http://Anglerstatic.com
http://showmanroast.com
http://coreladao.com
http://cdn.clubinfo.io
https://github.com/patriciauiokv
131.226.2.43
213.252.232.171
193.233.171.58
131.226.2.120
178.128.77.132
51.38.145.49
37.120.247.180
193.233.85.234
70.34.245.118
88.119.175.208
23.236.169.233
c963e65b9ec39b11076f78990c31f29aaa80705c75312dafd1748479e3e94ed0
33d057af74779925c4b2e720a820387cb89f8f65
6262a3339842240aeebae4ebfe338dbc771aa0e2df8f5a1ebcd7f9b090bedfe3
93424aa87731bb9b1d8cc1f708d2ac9f3faf914f368a00494d87cba3e7719e8c
83c7678492d623fb98834f0fbcb2e7b7f5af8950
411374feedcfa560335f00c0fcfa0a3906fdcc33687e6f924dd78ebecc45cd00
15ec300a4895a86322f1a27dd9ba0b9f8297e65d
4a366130118d750715c2d35fdc07509cf943fcc988fa5e6d02211e3d5472796e
bdd077f651ebe7f7b3ce16fe5f2b025be2969516
96244d83dc15d36847c35209bbdc5bdde9bec3d8
a0495b9421b0e81479b5271a041c9f28fc555800
d555789b146256253cd4540da28dcff6e44f6e50