Tag: Lazarus Group

  • Bybit Secures US Court Approval to Track Funds Stolen in $1.5B Lazarus Hack

    Bybit Secures US Court Approval to Track Funds Stolen in $1.5B Lazarus Hack

    In a significant legal victory, Bybit has obtained a U.S. federal court order allowing expedited discovery to trace assets linked to the $1.5 billion Lazarus Group hack. The ruling empowers the exchange to identify account holders, balances, and transaction histories from platforms operating in the United States.

    Court documents reveal that the order, issued in the District Court for the District of Columbia, permits Bybit to request detailed records before any changes occur. The lawsuit, filed under seal on June 18, targets North Korea’s Reconnaissance General Bureau, the Lazarus Group, and 20 unnamed defendants. The court approved expedited discovery the following day, while keeping certain exhibits sealed.

    To preserve identifiable assets, a temporary restraining order was issued on June 19, barring defendants from transferring specific funds. This order was renewed on July 16, and a partial preliminary injunction was granted on July 30. Bybit claims these legal steps are critical to freeze assets while the case proceeds.

    Despite these efforts, Bybit informed the court that 90.2% of the stolen assets had become untraceable by June 18. The funds were allegedly laundered through mixers, cross-chain bridges, and over-the-counter dealers, obscuring the transaction trail. Nonetheless, 9.8% of the total remains traceable, including $75.5 million that has either been frozen or returned to recovery channels.

    The February attack drained over 400,000 ETH and staked ETH from the Dubai-based exchange. Investigators linked the breach to compromised Safe Wallet infrastructure and developer credentials. The FBI officially attributed the theft to North Korea on February 26, 2025, under the operation name TraderTraitor.

    Bybit’s lawsuit seeks the return of stolen assets and $1.5 billion in compensatory damages, plus punitive and treble damages under the U.S. Racketeer Influenced and Corrupt Organizations Act. CEO Ben Zhou emphasized the company’s priority is to “protect our users first” and recover available funds, while holding those responsible accountable. Bybit plans to pursue further judicial relief and share blockchain records with investigators and regulators.

    North Korea has not publicly responded, and the defendants have yet to present a defense in unsealed filings. Parts of the proceedings remain confidential.

  • Bitcoin ETF Inflows Return, Lazarus Group Transfers BTC, and Hungary Eases Crypto Regulations

    Bitcoin ETF Inflows Return, Lazarus Group Transfers BTC, and Hungary Eases Crypto Regulations

    Crypto Market Roundup: Bitcoin ETF Inflows, Lazarus Group Activity, and Regulatory Shifts

    The crypto market saw a series of significant developments on July 30, 2026, as Bitcoin spot ETFs recorded net inflows, North Korea’s Lazarus Group moved a substantial amount of BTC, and Hungary streamlined its crypto regulations. Meanwhile, the CLARITY Act’s chances of passing in 2026 dropped to a new low.

    Bitcoin Spot ETFs See $32 Million Inflow After Outflow Streak

    According to data from SoSoValue, Bitcoin spot ETFs posted a total net inflow of $32.11 million on July 30, ending a four-session outflow streak. BlackRock’s IBIT led the charge with a daily net inflow of $89.83 million, bringing its historical net inflow to $60.42 billion. In contrast, Fidelity’s FBTC recorded the largest daily net outflow at $43.08 million, with a total historical net inflow of $9.96 billion. The combined net asset value of all Bitcoin spot ETFs now stands at $77.46 billion, representing a 6.08% net asset ratio. The historical cumulative net inflow has reached $51.36 billion, signaling renewed institutional interest in the asset class.

    Russia Detains BitRiver Founder in Fraud Investigation

    Russian authorities have escalated their case against Igor Runets, founder of the country’s largest cryptocurrency mining firm, BitRiver. The Zamoskvoretsky District Court of Moscow ordered Runets moved from house arrest to a pre-trial detention center, where he will remain for at least two months pending the investigation. Runets faces charges under Part 4 of Article 159 of the Russian Criminal Code, which covers fraud on an especially large scale committed by an organized group. Investigators allege that Runets and his company were involved in a crypto-mining equipment deal with the energy conglomerate En+ that resulted in damages of 1 billion rubles (approximately $12.5 million).

    North Korea’s Lazarus Group Moves $7.74 Million in Bitcoin

    Blockchain monitoring firm Lookonchain detected a transfer of 121.5 Bitcoin (BTC), valued at roughly $7.74 million, from a wallet associated with North Korea’s Lazarus Group to a new address. The transaction, which occurred on June 6, 2025, is part of the group’s ongoing efforts to launder funds from previous cyber heists. The Lazarus Group has been linked to major cryptocurrency thefts, including the $620 million Axie Infinity hack in 2022 and the $1.7 billion Bybit exploit in 2025.

    Hungary Streamlines Crypto Regulations Under MiCA Framework

    Hungary has taken steps to simplify its crypto regulatory environment. The Hungarian Parliament voted to repeal the country’s mandatory crypto validator rule, which had required certain crypto transactions to undergo third-party approval. This requirement, which took effect on July 1, 2025, operated alongside the European Union’s Markets in Crypto-Assets (MiCA) framework, creating a dual compliance burden for crypto asset service providers. With the repeal, Hungary has aligned more closely with MiCA, also applying a shortened transition period that required compliance by July 1, 2025—one year earlier than the EU’s maximum deadline. As a result, CoinCash has been authorized to resume operations in the country.

    CLARITY Act Odds Hit Record Low of 27%

    Prediction market Polymarket has set the probability of the CLARITY Act becoming law in 2026 at a record low of 27%, following a Senate delay. The Senate postponed action on the crypto market structure bill to consider a Russia sanctions package and federal nominees. Galaxy Digital similarly lowered its estimated probability of passage to 30%. With the Senate now focused on other legislative priorities and the August 8 recess approaching, the window for the CLARITY Act is shrinking. The Senate voted on July 28 to advance the sanctions legislation, leaving fewer working days for the crypto bill.

    Summary of Key Developments

    • Bitcoin ETF inflows: $32.11 million net inflow, led by BlackRock’s IBIT with $89.83 million.
    • Lazarus Group transfer: 121.5 BTC ($7.74 million) moved to a new wallet.
    • BitRiver founder: Igor Runets placed in pre-trial detention in Russia over alleged fraud.
    • Hungary crypto rules: Repeal of validator rule aligns with MiCA; CoinCash resumes operations.
    • CLARITY Act: Odds drop to 27% on Polymarket after Senate delay.
  • Crypto Hack Losses Drop 7% in June, Humanity Protocol Hit by $36M Exploit

    Crypto Hack Losses Drop 7% in June, Humanity Protocol Hit by $36M Exploit

    Crypto-related thefts declined in June after several months of heavy losses, although attackers continued targeting blockchain projects through private key compromises and bridge vulnerabilities. Blockchain security firm PeckShield reported about $75.9 million stolen across 40 major incidents, marking a 7.1% decrease from May’s $81.7 million.

    Even so, the monthly decline did little to slow the year’s overall losses. Data from blockchain intelligence firm TRM Labs showed crypto hacks and exploits have already cost the industry more than $750 million in 2026, with two large attacks recorded earlier this year accounting for a major share of that total.

    Humanity Protocol Records June’s Largest Exploit

    Humanity Protocol recorded the biggest security breach during June. PeckShield estimated the exploit at about $31 million, while the project’s internal investigation later placed losses closer to $36 million. According to the project, attackers gained access after compromising a private key linked to the protocol’s bridge administration.

    Founder Terence Kwok said the breach resulted from a compromised private key. Humanity Protocol also stated that attackers accessed bridge administration on Ethereum and BNB Chain after compromising a developer’s laptop. The project said the incident allowed hackers to drain wallets and mint about 447 million H tokens. Reports also stated that the exploit triggered an 80% to 90% decline in the token’s market price. Humanity Protocol added that it is preparing a recovery plan, including a possible 1:1 token airdrop for affected users. Meanwhile, reports linked the attack to North Korea’s Lazarus Group, although investigations remain ongoing.

    Bridge Exploits and Protocol Attacks Continue

    Beyond Humanity Protocol, several blockchain projects also suffered large losses during June. PeckShield reported that Syscoin Bridge lost about $10 million after attackers exploited a validation flaw that allowed billions of unsupported SYS tokens to be minted without the required token burn.

    A bot associated with the address JaredFromSubway.eth also lost about $7.5 million after being targeted by another exploit. Other affected platforms included Secret Network, Polymarket users, SecondFi and TESSERA, with reported losses ranging between $2.4 million and $4.67 million.

    Meanwhile, Aztec’s deprecated infrastructure was exploited twice during the month. PeckShield tracked approximately $2.16 million stolen from Aztec Bridge and another $2.1 million from Aztec Connect. According to the Aztec Foundation, both immutable contracts are no longer under its control and cannot be paused. Combined losses reached about $4 million.

    The remaining projects in PeckShield’s top ten included Taiko Bridge, Token of Power, Raydium and LABUBU/OLPC, with each incident resulting in losses exceeding $1 million.

    Crypto Losses Remain High in 2026

    Although June recorded a lower monthly total, overall crypto losses during 2026 remain elevated. TRM Labs estimated that hackers have already stolen more than $750 million this year. According to the firm, two attacks linked to North Korea accounted for much of those losses.

    On April 1, Drift Protocol lost about $285 million after attackers reportedly spent months using social engineering tactics against governance signers. Later, on April 18, Kelp DAO’s LayerZero bridge lost approximately $292 million after attackers compromised its verifier network.

    Meanwhile, PeckShield reported that the Humanity Protocol exploiter has moved stolen assets across Bitcoin, Solana, Hyperliquid, and BNB Chain. The firm also found that some funds were mixed with assets connected to the separate Kelp DAO exploit. PeckShield said this pattern ‘raises the possibility the same threat actor is behind both attacks,’ though no final attribution has been confirmed.