Bybit offers $140M bounty to trace stolen funds in record crypto heist

In the wake of what is believed to be the largest crypto heist in history, crypto exchange Bybit has launched a $140 million bounty program aimed at tracing and freezing approximately $1.4 billion in stolen Ethereum.

The bounty, announced by Bybit’s CEO and co-founder Ben Zhou on X (formerly Twitter) on Tuesday, is part of a broader effort to counteract the activities of the Lazarus Group—a North Korean-backed hacker collective accused of targeting cryptocurrency platforms.

Under the new bounty program, 5% of any traced and frozen stolen funds will be awarded to the individual who identifies them, with an additional 5% granted to the entity that facilitates the freeze. At the time of reporting, five bounty hunters have collectively received $4.23 million in rewards. The program’s official site, notable for its provocative logo depicting a knife impaling an image resembling North Korean leader Kim Jong-un, underscores the firm’s determination to hold perpetrators accountable.

“We will not stop until Lazarus or bad actors in the industry is eliminated. In the future, we will open it up to other victims of Lazarus as well,” Zhou stated, emphasizing the company's commitment to dismantling networks that support cybercriminal activity in the crypto space.

Multiple security researchers and crypto monitoring firms have pointed to strong evidence suggesting that the hackers behind the Bybit breach are working for the North Korean government. Governments of the United States, Japan, and South Korea have indicated that North Korean-linked cyber operations stole around $650 million in cryptocurrency in 2024 alone, highlighting the escalating threat facing digital asset platforms.

Preliminary forensic investigations led by Sygnia Labs and Verichains have provided further insights into the hack. Sygnia Labs identified the “root cause” as malicious code originating from the infrastructure of SafeWallet, a crypto wallet platform. Verichains added that a benign JavaScript file had been replaced with a malicious version designed specifically to target Bybit’s Ethereum Multisig Cold Wallet. Both investigations pointed to a breach of a developer’s device at SafeWallet, a vulnerability that SafeWallet has since confirmed.

Bybit’s aggressive bounty initiative marks a significant step in the ongoing battle against cybercrime in the cryptocurrency sector. As efforts intensify to trace and freeze the stolen funds, the program not only aims to recover assets but also sends a strong message to other potential bad actors in the industry.

Copied