STRIKE0 / OFFENSIVE SECURITYAUTONOMOUS RED TEAMING / HUMAN-DIRECTED
PUBLIC INCIDENT DOSSIER / 21 FEB 2025
THEFT / FBI-ATTRIBUTED

Bybit
Security incident.

The FBI attributed the theft of approximately USD 1.5 billion in virtual assets from Bybit to North Korean cyber actors.

$1.5B
DIGITAL ASSETS STOLENReported gross theft at the time. This is not an estimate of Bybit's net balance-sheet loss after any reimbursement or recovery.All incidents ↗
01 / DOCUMENTED FINDINGSPUBLIC-SOURCE ANALYSIS
WHAT HAPPENED

What the evidence shows.

The February 2025 exchange attack exposed the risk of multi-step transaction approval and wallet operations. The FBI characterized the activity as TraderTraitor and urged blockchain service providers to trace and block the resulting flows.

MEASUREMENT / INTERPRETATION

What the number means.

Reported gross theft at the time. This is not an estimate of Bybit's net balance-sheet loss after any reimbursement or recovery.

CONTROL QUESTIONS

How to test resilience.

Secure wallet transaction approvals, independent verification, compromised workflow detection and operational segregation.

Read cited source ↗
TURN LESSONS INTO VALIDATION

Find the path before an attacker does.

Discuss a scoped assessment ↗