Spoils of $1.5 Billion Bybit Hack Traced to Greek Crypto Exchange: Report

Proceeds from February’s mammoth $1.5 billion hack of crypto exchange Bybit have been traced to an unnamed Greek crypto exchange by the country’s authorities.

The attack, considered the largest of a crypto exchange in history, was later traced by on-chain investigators to North Korea’s Lazarus Group. The state-sponsored group has been tied to numerous high-profile cyberattacks in recent years, both inside and outside the crypto world.

The President of Greece’s Anti-Money Laundering Authority, Charalambos Vourliotis, said the regulator detected a “suspicious” transaction by a registered user of the Greek exchange in May, according to a press conference reported on by Greek newspaper Proto Thema. The user’s Ethereum wallet reportedly received a “large quantity” of the cryptocurrency.

Following an investigation by its analysts, the transactions were then linked to funds stolen from the Bybit hack. A seizure order has reportedly been issued for the funds by the authority for the user’s crypto wallet, and a report has been submitted to the country’s Prosecutor’s Office for further legal action.

Though many well-known international exchanges are licensed to operate in Greece, including Coinbase, Kraken, and Gemini, the country also has several locally-based, domestically focused exchanges, such as Bcash.

The announcement could have wider knock-on effects for Greek crypto users. Proto Thema reports that cryptocurrencies “are now also falling under the scrutiny” of the country’s Anti-Money Laundering Authority.

Tracing Bybit’s stolen funds

Bybit managed to retain liquidity in the immediate aftermath of the devastating attack, leaning on short-term “bridge loans” from other crypto firms like Galaxy Digital, FalconX, and Wintermute, but many of the stolen funds have yet to be recovered.

Bybit claims to have recovered $42.89 million of the assets at the time of writing, with roughly 88.87% of the missing crypto traceable to investigators on the blockchain as of late March.

However, Bybit says that around 7.59% of the funds have “gone dark,” due to the use of anonymity-preserving tools like cryptocurrency mixers such as Wasabi, CryptoMixer, Railgun, and Tornado Cash, meaning they will likely never be recovered.  An additional 3.54% of funds have been frozen through collaboration with other exchanges.

Reports on the incident have noted the complexity and speed of the North Korean team’s money laundering operations, saying this may suggest the presence of complex crypto-laundering infrastructure in neighboring countries like China.

Edited by Stephen Graves