Loading ForensicBlock
Preparing your blockchain forensics platform...
Preparing your blockchain forensics platform...
A forensic breakdown of the largest exchange hack in cryptocurrency history — from the Safe multisig compromise to THORChain laundering and FBI attribution.
On February 21, 2025, attackers compromised Bybit's Safe (formerly Gnosis Safe) multisig wallet contract, draining approximately $1.5 billion in ETH and ERC-20 tokens. The exploit did not rely on a smart contract vulnerability in the traditional sense — instead, the attackers manipulated the multisig signing process itself, likely through a supply-chain compromise of the Safe UI or a targeted social engineering operation against key signers.
Within hours, the FBI publicly attributed the attack to North Korea's Lazarus Group, marking it as the single largest cryptocurrency exchange hack in history — surpassing the 2022 Ronin Bridge exploit ($625M) by more than double.
ForensicBlock's AI agents began tracing the stolen funds within minutes of the exploit. The attacker's primary address, 0x47666fab8bd0ac7003bce3f5c3585383f09486e2, immediately began splitting and routing funds through a multi-layered obfuscation strategy:
ForensicBlock deployed its full 9-agent protocol on the Bybit attacker address. Here is how each agent contributed to the investigation:
Mapped the fund flow graph across 50+ wallets and 3 chains, identifying THORChain as the primary bridge.
Flagged the attacker address as CRITICAL (100/100) within seconds based on OFAC sanctions data and Lazarus Group pattern matching.
Classified the attack as a multisig compromise with state-sponsored attribution, generating a 17-category risk profile.
Identified 4 exchange deposit addresses and generated freeze request templates for Binance, OKX, and Huobi.
Set up real-time monitoring on all intermediary wallets, alerting on every subsequent fund movement.
Generated a court-ready PDF with SHA-256 verification, chain of custody documentation, and Daubert-compliant methodology.
The Bybit hack fits a well-documented pattern of DPRK-affiliated cryptocurrency theft. The United Nations Security Council Report S/2024/215 documented that North Korea's cyber operations stole an estimated $3.5 billion in cryptocurrency between 2017 and 2024. The Bybit attack added $1.5B to that total in a single operation.
Key behavioral signatures that ForensicBlock's AI identified as consistent with Lazarus Group operations:
The Bybit hack is available as a Cold Case on ForensicBlock. Start with the attacker's seed address and let 6 AI agents trace the funds across chains, through mixers, and into exchange deposit wallets.