North Korean hackers cash out hundreds of millions from $1.5bn ByBit hack
Hackers thought to be working for the North Korean regime have successfully converted at least $300m (£232m) of their record-breaking $1.5bn crypto heist to unrecoverable funds.
The criminals, known as Lazarus Group, swiped the huge haul of digital tokens in a hack on crypto exchange ByBit two weeks ago.
Since then, it's been a cat-and-mouse game to track and block the hackers from successfully converting the crypto into usable cash.
Experts say the infamous hacking team is working nearly 24 hours a day - potentially funnelling the money into the regime's military development.
"Every minute matters for the hackers who are trying to confuse the money trail and they are extremely sophisticated in what they're doing," says Dr Tom Robinson, co-founder of crypto investigators Elliptic.
Out of all the criminal actors involved in crypto currency, North Korea is the best at laundering crypto, Dr Robinson says.
"I imagine they have an entire room of people doing this using automated tools and years of experience. We can also see from their activity that they only take a few hours break each day, possibly working in shifts to get the crypto turned into cash."
Elliptic's analysis tallies with ByBit, which says that 20% of the funds have now "gone dark", meaning it is unlikely to ever be recovered.
The US and allies accuse the North Koreans of carrying out dozens of hacks in recent years to fund the regime's military and nuclear development.
On 21 February the criminals hacked one of ByBit's suppliers to secretly alter the digital wallet address that 401,000 Ethereum crypto coins were being sent to.
ByBit thought it was transferring the funds to its own digital wallet, but instead sent it all to the hackers.
Ben Zhou, the CEO of ByBit, assured customers that none of their funds had been taken.
The firm has since replenished the stolen coins with loans from investors, but is, in Zhou's words, "waging war on Lazarus".
ByBit's Lazarus Bounty programme is encouraging members of the public to trace the stolen funds and get them frozen where possible.
All crypto transactions are displayed on a public blockchain, so it's possible to track the money as it's moved around by the Lazarus Group.
If the hackers try to use a mainstream crypto service to attempt to turn the coins into normal money like dollars, the crypto coins can be frozen by the company if they think they are linked to crime.
So far 20 people have shared more than $4m in rewards for successfully identifying $40m of the stolen money and alerting crypto firms to block transfers.
But experts are downbeat about the chances of the rest of the funds being recoverable, given the North Korean expertise in hacking and laundering the money.
"North Korea is a very closed system and closed economy so they created a successful industry for hacking and laundering and they don't care about the negative impression of cyber crime," Dr Dorit Dor from cyber security company Check Point said.
Another problem is that not all crypto companies are as willing to help as others.
Crypto exchange eXch is being accused by ByBit and others of not stopping the criminals cashing out.
More than $90m has been successfully funnelled through this exchange.
But over email the elusive owner of eXch - Johann Roberts - disputed that.
He admits they didn't initially stop the funds, as his company is in a long-running dispute with ByBit, and he says his team wasn't sure the coins were definitely from the hack.
He says he is now co-operating, but argues that mainstream companies that identify crypto customers are betraying the private and anonymous benefits of crypto currency.
North Korea has never admitted being behind the Lazarus Group, but is thought to be the only country in the world using its hacking powers for financial gain.
Previously the Lazarus Group hackers targeted banks, but have in the last five years specialised in attacking cryptocurrency companies.
The industry is less well protected with fewer mechanisms in place to stop them laundering the funds.
Recent hacks linked to North Korea include:
The 2019 hack on UpBit for $41m
The $275m theft of crypto from exchange KuCoin (most of the funds were recovered)
The 2022 Ronin Bridge attack which saw hackers make off with $600m in crypto
Approximately $100m in crypto was stolen in an attack on Atomic Wallet in 2023
In 2020, the US added North Koreans accused of being part of the Lazarus Group to its Cyber Most Wanted list. But the chances of the individuals ever being arrested are extremely slim unless they leave their country.
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Business Insider
4 hours ago
- Business Insider
‘Do Not Buy' SharpLink Gaming Stock (SBET) Warns Martin Shkreli
Investor Martin Shkreli has warned his followers on X, formerly Twitter, that SharpLink Gaming (SBET) isn't a stock worth buying. Specifically, the businessman said, 'may go to 500-1000 (i bought small, do not buy).' Confident Investing Starts Here: Shkreli highlighted SBET stock after the shares surged this week on news that it's creating an Ethereum (ETH) treasury. It has raised $425 million to do so through a private investment in public equity (PIPE). Investors will also keep in mind that Ethereum co-founder Joseph Lubin has joined SharpLink Gaming as its Chairman of the Board. Shkreli's comments on SharpLink Gaming stock carry a lot of weight. That's due to his history as an investor and the lack of analyst coverage for SBET. This has retail traders closely watching the advice of online investing personalities to get a read on SharpLink Gaming. SharpLink Gaming stock movement this week has been phenomenal. The shares have rocketed 2,639.93% over the last five days, largely thanks to its Ethereum treasury announcement. That rally continued on Friday, with SBET stock rising another 12.07%. Despite the huge interest in SBET stock, its daily active trading has hovered around 2 million shares. Shkreli shed light on this in his X post. He noted that the SharpLink Gaming float is less than 2 million shares. This is due to a registration rights agreement on the 69 million shares issued that won't be effective for months. This leaves it with a tradable market capitalization of roughly $130 million. Is SBET Stock a Buy, Sell, or Hold? While analyst coverage of SharpLink Gaming is lacking, TipRanks' AI analyst, Spark, has weighed in on the company. It offers an Underperform (40) rating for the shares and no price target. SBET stock may get more analyst coverage following its dive into Ethereum.
Business Upturn
6 hours ago
- Business Upturn
How to make over $10,000 a day: XRP enthusiasts realize their dreams on the SAVVY MINING platform.
By GlobeNewswire Published on May 31, 2025, 03:00 IST New York City, USA, May 30, 2025 (GLOBE NEWSWIRE) — XRP is back in the spotlight—and this time, it's not just the price driver. With strong trading volume, an efficient ETF structure, and growing regulatory clarity, Ripple (XRP) is poised to lead the next wave of cryptocurrency popularity. While the market is still speculating whether XRP will be the next altcoin to receive spot ETF approval in the U.S., savvy investors are already jumping in to earn a steady daily passive income by joining SAVVY MINING, the world's top cloud mining platform service provider. Welcome to SAVVY MINING, a UK Financial Conduct Authority (FCA)-regulated platform designed to turn XRP holders into high-income cloud XRP Enthusiasts Choose SAVVY MINING Cloud Mining Platform Bitcoin and Ethereum have dominated the ETF space, and XRP is showing signs of becoming the next leader. But savvy investors know that the hype of ETFs doesn't necessarily translate into daily returns. That's why more and more XRP holders are choosing SAVVY MINING for cloud mining to earn stable returns with zero trading risk. With cloud mining, you can remotely access high-performance mining equipment without having to purchase or maintain local mining machines, and easily obtain daily cryptocurrency income. SAVVY MINING combines artificial intelligence scheduling systems and clean energy solutions to provide XRP users with a one-stop efficient mining experience, making mining smarter, greener, and more sustainable. Start earning a stable income in just three steps:Step 1: Register an AccountIt only takes less than a minute to sign up, you can open an account for free and receive a new user bonus worth $15. In addition, you can automatically receive $0.6 in income every day, making it easy to start your cloud mining 2: Choose a contract planWe offer a variety of high-yield mining plans to meet your financial goals. Whether you are looking for short-term gains or long-term returns, SAVVY MINING has you 3: Start EarningEasily control your income growth without any management. Daily earnings will be automatically deposited into your account, and you can also withdraw it to your cryptocurrency wallet following illustrates the potential benefits you can realize.⦁【Experience Contract】: Investment amount: $100, total net profit: $100 + $10.2.⦁【AntMiner S17 Pro】: Investment amount: $600, total net profit: $600 + $60.⦁【Whats Miner M61】: Investment amount: $3,000, total net profit: $3,000 + $616.5.⦁【ETCMinerE9 Pro】: Investment amount: $5,500, total net profit: $5,500 + $2,376.⦁【ALPHMinerAL1】: Investment amount: $13,800, total net profit: $13,800 + $10,308.6.⦁【ANTSPACE HW5】：Investment amount: $100,000, total net profit: $10,0000 + $104, purchasing the contract, the income will be automatically credited to your account the next day. When the account balance reaches $100, you can choose to withdraw to your crypto wallet, or continue to purchase contracts to get more income. Everything is safe and transparent-official operation, control your financial freedom anytime, anywhere, download the official APP with one click, and support Apple and Android mobile APP applications. (Click to download mobile APP) SAVVY MINING 7 major advantages:1: Professional customer service team provides 7×24 hours online service, answering any questions of customers within 1-5 minutes.2: The platform supports multiple currencies for recharge and withdrawal: such as USDT-TRC20, BTC, ETH, LTC, USDC, XRP, USDT-ERC20, BCH, DOGE, SOL, etc.3: Environmental protection concept: Use energy to generate electricity, and use the free and recyclable electricity provided by nature (wind, water, solar, etc.) to provide a stable power supply for mining machines.4: National-level security guarantee: Fund SSL encryption + data encryption to ensure the security of each user's account and funds.5: Strong platform strength: 8 years of safe operation, 80+ mining farms worldwide, serving more than 8 million users.6: Recommend friends to join and get a permanent 3%+1.5% referral reward, up to $100,000. (For example: you can get a $30 bonus if someone you invite buys a $1,000 contract) 7: High returns, daily fees, no other service fees and management fees. Safe and reliableSAVVY MINING is fully regulated by the UK Financial Conduct Authority (FCA) to ensure compliance, transparency and legal protection for every investor. With national-level security, smart contracts and cold wallet asset protection, your funds are safe and unofficial platforms or short-term schemes, SAVVY MINING has earned a solid reputation for consistent returns, honest performance, and real-time transparency. Whether you are an early investor in XRP or a cryptocurrency newbie, this is your chance to turn your holdings into a daily source of income while contributing to a sustainable AI-driven blockchain infrastructure. For more information about SAVVY MINING, visit the official website: explore and start your investment income journey with one click. Contact us: [email protected] Disclaimer: The information provided in this press release is not a solicitation for investment, nor is it intended as investment advice, financial advice, or trading advice. Cryptocurrency mining and staking involve risk. There is potential for loss of funds. It is strongly recommended you practice due diligence, including consultation with a professional financial advisor, before investing in or trading cryptocurrency and securities. Disclaimer: The above press release comes to you under an arrangement with GlobeNewswire. Business Upturn takes no editorial responsibility for the same. GlobeNewswire provides press release distribution services globally, with substantial operations in North America and Europe.
Yahoo
6 hours ago
- Yahoo
North and South Korea are in an underground war - Kim Jong Un might now be winning
Listen to Jean read this article The border between North and South Korea is swamped with layers of dense barbed-wire fencing and hundreds of guard posts. But dotted among them is something even more unusual: giant, green camouflaged speakers. As I stood looking into the North one afternoon last month, one of the speakers began blasting South Korean pop songs interspersed with subversive messages. "When we travel abroad, it energises us", a woman's voice boomed out across the border - an obvious slight given North Koreans are not allowed to leave the country. From the North Korean side, I could faintly hear military propaganda music, as its regime attempted to drown out the inflammatory broadcasts. North and South Korea are technically still at war, and although it has been years since either side shelled the other, the two sides are fighting on a more subtle front: a war of information. The South tries to get information into the North, and North Korea's leader Kim Jong Un tries furiously to block it, as he attempts to shield his people from outside information. North Korea is the only country in the world the internet has not penetrated. All TV channels, radio stations and newspapers are run by the state. "The reason for this control is that so much of the mythology around the Kim family is made up. A lot of what they tell people is lies," says Martyn Williams, a senior fellow at the Washington-based Stimson Center, and an expert in North Korean technology and information. Expose those lies to enough people and the regime could come crumbling down, is how the thinking in South Korea goes. The loudspeakers are one tool used by the South Korean government, but behind the scenes a more sophisticated underground movement has flourished. A small number of broadcasters and non-profit organisations transmit information into the country in the dead of night on short and medium radio waves, so North Koreans can tune in to listen in secret. Thousands of USB sticks and micro-SD cards are also smuggled over the border every month loaded with foreign information - among them, South Korean films, TV dramas, and pop songs, as well as news, all designed to challenge North Korean propaganda. But now those working in the field fear that North Korea is gaining the upper hand. Not only is Kim cracking down hard on those caught with foreign content, but the future of this work could be in jeopardy. Much of it is funded by the US government, and has been hit by US President Donald Trump's recent aid cuts. So where does this leave both sides in their longstanding information war? Every month, a team at Unification Media Group (UMG), a South Korean non-profit organisation, sift through the latest news and entertainment offerings to put together playlists that they hope will resonate with those in the North. They then load them onto devices, which are categorised according to how risky they are to view. On low-risk USBs are South Korean TV dramas and pop songs - recently they included a Netflix romance series When Life Give You Tangerines, and a hit from popular South Korean singer and rapper Jennie. High-risk options include what the team calls "education programmes" – information to teach North Koreans about democracy and human rights, the content Kim is thought to fear the most. The drives are then sent to the Chinese border, where UMG's trusted partners carry them across the river into North Korea at huge risk. South Korean TV dramas may seem innocuous, but they reveal much about ordinary life there - people living in high-rise apartments, driving fast cars and eating at upmarket restaurants. It highlights both their freedom and how North Korea is many years behind. This challenges one of Kim's biggest fabrications: that those in the South are poor and miserably oppressed. "Some [people] tell us they cried while watching these dramas, and that they made them think about their own dreams for the very first time", says Lee Kwang-baek, director of UMG. It is difficult to know exactly how many people access the USBs, but testimonies from recent defectors seem to suggest the information is spreading and having an impact. "Most recent North Korean defectors and refugees say it was foreign content that motivated them to risk their lives to escape", says Sokeel Park, whose organisation Liberty in North Korea works to distribute this content. There is no political opposition or known dissidents in North Korea, and gathering to protest is too dangerous – but Mr Park hopes some will be inspired to carry out individual acts of resistance. Kang Gyuri, who is 24, grew up in North Korea, where she ran a fishing business. Then in late 2023, she fled to South Korea by boat. Watching foreign TV shows partly inspired her to go, she says. "I felt so suffocated, and I suddenly had an urge to leave." When we met in a park on a sunny afternoon in Seoul last month, she reminisced about listening to radio broadcasts with her mum as a child. She got hold of her first K-drama when she was 10. Years later she learnt that USB sticks and SD cards were being smuggled into the country inside boxes of fruit. The more she watched, the more she realised the government was lying to her. "I used to think it was normal that the state restricted us so much. I thought other countries lived with this control," she explains. "But then I realised it was only in North Korea." Almost everyone she knew there watched South Korean TV shows and films. She and her friends would swap their USBs. "We talked about the popular dramas and actors, and the K-pop idols we thought were good looking, like certain members of BTS. "We'd also talk about how South Korea's economy was so developed; we just couldn't criticise the North Korean regime outright." The shows also influenced how she and her friends talked and dressed, she adds. "North Korea's youth has changed rapidly." Kim Jong Un, all too aware of this risk to his regime, is fighting back. During the pandemic, he built new electric fences along the border with China, making it more difficult for information to be smuggled in. And new laws introduced from 2020 have increased the punishments for people who are caught consuming and sharing foreign media. One stated that those who distribute the content could be imprisoned or executed. This has had a chilling effect. "This media used to be available to buy in markets, people would openly sell it, but now you can only get it from people you trust," says Mr Lee. After the crackdown began Ms Kang and her friends became more cautious too. "We don't talk to each other about this anymore, unless we're really close, and even then we're much more secretive," she admits. She says she is aware of more young people being executed for being caught with South Korean content. Recently Kim has also cracked down on behaviour that could be associated with watching K-dramas. In 2023 he made it a crime for people to use South Korean phrases or speak in a South Korean accent. Members of 'youth crackdown squads', patrol the streets, tasked with monitoring young people's behaviour. Ms Kang recalls being stopped more often, before she escaped, and reprimanded for dressing and styling her hair like a South Korean. The squads would confiscate her phone and read her text messages, she adds, to make sure she had not used any South Korean terms. In late 2024, a North Korean mobile phone was smuggled out of the country by Daily NK, (Seoul-based media organisation UMG's news service). The phone had been programmed so that when a South Korean variant of a word is entered, it automatically vanishes, replaced with the North Korean equivalent - an Orwellian move. "Smartphones are now part and parcel of the way North Korea tries to indoctrinate people", says Mr Williams. Following all these crackdown measures, he believes North Korea is now "starting to gain the upper hand" in this information war. Following Donald Trump's return to the White House earlier this year, funds were severed to a number of of aid organisations, including some working to inform North Koreans. He also suspended funds to two federally financed news services, Radio Free Asia and Voice of America (VOA), which had been broadcasting nightly into North Korea. Trump accused VOA of being "radical" and anti-Trump", while the White House said the move would "ensure taxpayers are no longer on the hook for radical propaganda". But Steve Herman, a former VOA bureau chief based in Seoul, argues: "This was one of the very few windows into the world the North Korean people had, and it has gone silent with no explanation." Xi's real test is not Trump's trade war Channel migrants: The real reason so many are fleeing Vietnam for the UK Syrians have more freedom after Assad, but could they soon lose it? UMG is still waiting to find out whether their funding will be permanently cut. Mr Park from Liberty in North Korea argues Trump has "incidentally" given Kim a helping hand, and calls the move "short-sighted". He argues that North Korea, with its expanding collection of nuclear weapons, poses a major security threat - and that given sanctions, diplomacy and military pressure have failed to convince Kim to denuclearise, information is the best remaining weapon. "We're not just trying to contain the threat of North Korea, we're trying to solve it," he argues. "To do that you need to change the nature of the country. "If I was an American general I'd be saying 'how much does this stuff cost, and actually that's a pretty good use of our resources'". The question that remains is, who should fund this work. Some question why it has fallen almost entirely to the US. One solution could be for South Korea to foot the bill - but the issue of North Korea is heavily politicised here. The liberal opposition party tends to try to improve relations with Pyongyang, meaning funding information warfare is a no go. The party's frontrunner in next week's presidential election has already indicated he would turn off the loudspeakers if elected. Yet Mr Park remains hopeful. "The good thing is that the North Korean government can't go into people's heads and take out the information that's been building for years," he points out. And as technologies develop, he is confident that spreading information will get easier. "In the long run I really believe this is going to be the thing that changes North Korea". Top image credit: Getty BBC InDepth is the home on the website and app for the best analysis, with fresh perspectives that challenge assumptions and deep reporting on the biggest issues of the day. And we showcase thought-provoking content from across BBC Sounds and iPlayer too. You can send us your feedback on the InDepth section by clicking on the button below.
