• Coinscript
  • Posts
  • 🗞️ The Largest Theft in History

🗞️ The Largest Theft in History

Bybit just suffered the largest crypto hack in history—a $1.46 billion theft allegedly linked to North Korea’s Lazarus Group. Hackers used malware to drain funds and are now laundering them through DEXs, cross-chain bridges, and mixers like Tornado Cash.

Hello, this is Coinscript.

In today’s episode:

  • ✍️ The Largest Theft in History

TOP STORY

The Largest Theft in History

Crypto is great at breaking records. Even the bad ones.

Bybit got hit with the largest heist in history. You heard me… IN HISTORY.

On February 21st more than $1.46 BILLION worth of crypto was stolen from Bybit by hackers.

Someone (allegedly North Korea’s Lazarus Group) ran off with more money than Saddam Hussein did back in the day ($1B from Iraq’s Central Bank in 2003).

That’s a flex, but not the good kind.

The hackers pulled off the crypto version of Ocean’s Eleven using malware to trick Bybit into approving fake transactions.

And they didn’t waste time—within minutes, they started swapping stolen tokens for ETH (because, surprise, surprise, centralized issuers like Tether (USDT) and Circle (USDC) can freeze stolen tokens, but no one can touch your ETH).

Now, the funds are going through the ultimate game of crypto hide-and-seek:

✅ Sent to 50+ wallets with 10K ETH each
✅ Funneled through DEXs, cross-chain bridges, and sketchy exchanges
✅ Washed in crypto mixers (aka Tornado Cash’s washing machine)

Hackers are now laundering the stolen crypto assets, which Elliptic claims are similar to North Korea’s Lazarus Group.

But, how does Lazarus launder it? (FOR EDUCATIONAL PURPOSES ONLY!!)

1️⃣ Swap the Frozen Stuff – First move? Dump any tokens that centralized issuers can freeze (like USDT, USDC) for ETH or BTC using decentralized exchanges (DEXs). No KYC (Know You Customer), no problem.

2️⃣ Break It Up – Instead of keeping $1.46B in one wallet (a rookie move), they split it into hundreds of wallets, each with smaller amounts to avoid raising red flags.

3️⃣ Cross-Chain Bridges – Move funds between blockchains to shake off blockchain detectives. If ETH is getting too hot, they hop over to Bitcoin, Tron, or even obscure networks.

4️⃣ Mixers & Tumblers – Once they have BTC, it’s time for a crypto car wash. Services like Tornado Cash mix their funds with thousands of other transactions, making it nearly impossible to trace the original source.

5️⃣ Sketchy Exchanges & P2P Markets – Finally, they cash out through shady exchanges (like eXch) that don’t enforce KYC, or via peer-to-peer (P2P) deals, where crypto is traded for cash, gift cards, or other assets.

It might sound simple, but it actually looks a lot like this:

(A screenshot of a small subset of actual transactions used to launder the funds stolen from ByBit. The assets are flowing from top to bottom)

The exchange, “eXch,” is playing the role of a very willing accomplice, letting the hackers move over $75M of stolen funds—despite Bybit waving a giant red flag.

What’s next? If history repeats itself, they’ll swap it all for BTC and launder it further. But with $1.46B on the move, even North Korea might struggle to make it all disappear.

Meanwhile, Bybit, Elliptic, and investigators are working overtime to track it all down.

Will they stop Lazarus before the money funds North Korea’s missile program?

North Korea has stolen over $6 billion worth of crypto assets since 2017!

Bybit Took it Like a Champ!

Bybit’s CEO Ben Zhou posted on X following the incident that all of the client’s assets are 1 to 1 backed, and that they can cover the loss!

Talk about a good PR campaign!

Since the hack, Bybit has been already able to fully close the ETH gap and is reportedly back to 100% 1:1 on client assets!

Hats down Bybit, hats down!

Meme of the Day 🤣

source: naiivememe

Do you still have all of your Crypto on exchange?

Protect your investment with the #1 Crypto Wallet!

Rate today's edition

What did you think of today's edition?

Login or Subscribe to participate in polls.

DISCLAIMER: None of this is financial advice. This newsletter is strictly educational and is not investment advice or a solicitation to buy or sell any assets or to make any financial decisions. Please be careful and do your own research.