Get the Full Report

Enter your email below to view

Bybit Hack: How the Lazarus Group Exploited DeFi Protocols to Launder $400M

Crosschain analysis shows Lazarus leveraged DeFi protocols to launder funds

Mar 25, 2025
Market Structure
Stablecoins
Read full report

Bybit, the world’s second-largest exchange by trading volume, recently suffered the largest crypto hack in history. On February 21, 2025, North Korea’s Lazarus Group stole $1.46 billion in Ethereum tokens from Bybit and immediately began laundering the funds to cash out.

While many reports detailed how THORChain, ParaSwap, and token transfers were used to launder funds, we analyzed cross-chain DeFi & DEX activity to shed light on an untold part of the story: the Lazarus Group used DeFi aggregators to discreetly swap $386 million through DeFi protocols.

Though Lazarus laundered one-fifth of the stolen funds ($263M) through PancakeSwap alone, this is the first report on the Bybit hack to highlight the protocol (at the time of writing) and the role of aggregators. Allium’s cross-chain data enabled our wizards to track and visualize every transaction on Ethereum within five layerur analysis involved:

  • 13,000 unique wallets,
  • 127,000 transactions,
  • With a cumulative volume of $12 billion,
  • 5 hops away from the genesis node.
Bybit Hack: How the Lazarus Group Exploited DeFi Protocols to Launder $400M

More from Allium Research

Get new Allium research in your inbox

October 15, 2026
State of Stablecoins and Payments
Allium's Q3 2026 report measures stablecoin supply, adjusted volume, payments, agentic payments and card spend through September 30, 2026, with commentary from 17 industry contributors. Supply grew 0.4% this year to $305B, while payments grew 45% to $482B as payment count rose 71% and the average payment fell. By Elton Shehdula, Head of Research @Allium Maksym Sherman, Research @Allium Olivia Denk, Research @Allium
Read
August 5, 2026
Circle's revenue tracks USDC supply, and supply is falling
Interest on the USDC reserves is 94 percent of Circle's revenue, and the balance it accrues on is published every day. That balance peaked at $79.2B on 17 March 2026 and stands at $71.8B, so Allium estimates $667M of reserve interest for Q2 '26 against $733M in Q4 '25, Circle's best quarter. The September quarter is already tracking near $640M with 35 of its 92 days measured, which makes the next four quarters a question about supply rather than about the print.
Read
December 16, 2025
In the Shadow of Bank Runs: Lessons from the Silicon Valley Bank Failure and Its Impact on Stablecoins
Read
Explore the Full Research Library

Finance is moving onchain. Allium is the system of record it runs on.

Explore terminal
Talk to us now
Decorative
Finance is moving onchain. Allium is the foundation it runs on.