In February 2025 the Dubai-based exchange Bybit lost approximately $1.447 billion in Ethereum — the largest single cryptocurrency theft on record. The FBI attributed it to the North Korean cluster it tracks as TraderTraitor, within the broader Lazarus grouping.
The Scale Is A Category Difference, Not A Degree
This desk filed the aggregate picture at 26-0722: DPRK-linked actors accounting for roughly three quarters of all crypto theft value, on a cumulative total above $6.75 billion. This one incident is a fifth of that cumulative figure.
For comparison, the reported total for all cyber-enabled fraud complaints to the FBI in a full year — filed at 26-0510 — was around $20.9 billion. A single theft at 7% of that is not a crime statistic; it is a line item in a national budget.
Attribution Here Is Unusually Solid
This desk grades most nation-state attribution medium. Cryptocurrency theft is the exception, for the reason set out at 26-0722: the ledger is public, fund movement is traceable continuously, and laundering patterns recur across incidents in ways any analyst with the same data can check.
A formal agency attribution on top of that evidential base is about as firm as attribution in this field gets.
What It Funds Is The Point
United Nations panel reporting has linked proceeds attributed to DPRK operations to weapons procurement. On that basis an exchange compromise of this size is not opportunistic crime that a state tolerates — it is a state revenue event.
For a defender the practical consequence is the one filed at 26-0722: the adversary is not deterred by cost, is not seeking the easiest target, and does not stop when a route closes.
Compiled from public reporting and agency attribution, listed below. The loss figure is as reported at the time and is subject to valuation at the date of theft. Corrections: corrections@forensicpost.com.