Bybit CEO Ben Zhou declares war on Lazarus

[bbc.reporter]

Where are the onchain analysis experts? I reckon there are many of them in this forum who are always scanning the wallets of the signature campaigners of this forum heheheheh. This might be your chance to retire! Bybit is offering $140 million for a bounty to help them recover some of the stolen cryptocoins.

I speculate that on this Ben Zhou, the Lazarus Group has made a mistake on stealing from him. Ben appears that he is similar to this character in Taken where the father will not stop until he will find his daughter hehehe.


Ben Zhou from the movie Taken

Bybit pitches $140m bounty for those who help round up its stolen crypto

Crypto exchange Bybit is offering up to $140 million to onchain sleuths who help track down the $1.4 billion the exchange lost in Friday’s hack.

Those who play an active role in the recovery of portions of the stolen funds stand to receive 10% as a reward.

“We want to officially reward our community who lent us their expertise, experience and support,” Ben Zhou, co-founder and CEO of Bybit, said in a statement.

Read in full https://www.dlnews.com/articles/defi/bybit-hack-bounty-and-ethena-raise-rock-defi/

[_act_]

Let us see what would happen. But what that is important most is prevention. Prevention is always better than cure. The hack is one of the most simple hack an exchange can avoid but the exchange was fooled and sign a multisig transaction from cold wallet. Make sure you always know the address that you are sending to and make sure you avoid sending to a wrong address.

I guess the money is gone.

[$crypto$]

- https://www.lazarusbounty.com/

So far, we have only seen Mantle freeze $41,917,500 and a few others that have been reported.
There could be many more bounty reports from several sources and Ben is currently collecting them.

It will be interesting to see how far Bybit gets back the lost funds.

[TheUltraElite]

If Zhou can bring the hackers to justice, then more power to him, I take no prisoners when it comes to fraud and to me punishment is what is necessary for such scumbags.

However this might end up being an inside job in which case he will have to go backfoot or just a publicity stunt because most of the hackers have not been caught yet. This group has been involved in many scams and hacks and they are doing it well with inside people is what I presume.

Even the Wazirx hack could do nothing with their bounty campaigns. These groups obviously have political support.

[EarnOnVictor]

Where are the onchain analysis experts? I reckon there are many of them in this forum who are always scanning the wallets of the signature campaigners of this forum heheheheh. This might be your chance to retire! Bybit is offering $140 million for a bounty to help them recover some of the stolen cryptocoins.

Hahaha...you must be "making gest of someone" right now, if you don't have the wing, how do you intend to fly? That supposed strongness can't be beyond the forum, I suppose.

Well, I hope Bybit gets its money back, but that hasn't happened in the history of Lazarus Group, especially when it's such that is allegedly backed by a military regime that has zero respect for the rule of law. Who knows, that offered amount ($140m) may motivate the greatest hackers in the world whose names are not even known. Let's see how it goes.

[Lucius]

Instead of investing that $140 million in the security of their platform, they are now playing some kind of hero who is throwing money away to do exactly what? Besides, is anyone so naive as to really think that there is only one group of hackers in the world and that the rest of the world is super honest and doesn't deal with it?

[Rikafip]

If Zhou can bring the hackers to justice, then more power to him, I take no prisoners when it comes to fraud and to me punishment is what is necessary for such scumbags.

If its true what they say and Lazarus is actually behind this, then chances of him bringing them to justice are slim to none. I mean, they are supposed to be protected/directed by North Korea government, meaning there is nothing they can do other than try to freeze some funds and retrive if possible.

As others have said, Bybit should focus on improving their security instead, as that's something that they can actually do.

[dkbit98]

It's always someone else to blame, now it's lazarus group again, tomorrow some different evil hackers.
Instead of blaming others and tracking coins, they should improve their security and stop using crap like ledger and safe wallet.
Latest audit from security firms was just released with interesting new findings:
https://decrypt.co/307866/how-bybit-hacked-1-4-billion-ethereum

[hugeblack]

If we are talking about hackers from NK, what would motivate them to return 90% of the amount and keep 10% if they are actually in a country subject to economic sanctions and no matter what they do, financial policies towards them will not change. whoever succeeded in withdrawing a billion dollars will certainly not plan to return them.

[examplens]

Instead of investing that $140 million in the security of their platform

They do not invest $140 million in the fight against Lazarus, but it is 10% of the total hacked amount. So, from the found and blocked hacked coins, they will give 10% to whoever helped. So that's up to $140 million. At the same time, 5% goes to the one who reported the suspicious transaction and 5% to the exchange or who already blocked the funds.

[Lucius]

Instead of investing that $140 million in the security of their platform

They do not invest $140 million in the fight against Lazarus, but it is 10% of the total hacked amount. So, from the found and blocked hacked coins, they will give 10% to whoever helped. So that's up to $140 million. At the same time, 5% goes to the one who reported the suspicious transaction and 5% to the exchange or who already blocked the funds.

From everything written, it seems to me that they have declared war on them - but what I wanted to say is that they should work on prevention, not wait for something like this to happen and then try to repair the damage by offering a bunch of money to whoever can save what can be saved.

Besides, who hacked them? First they said it wasn't the NK guys, now they say it was, tomorrow someone will reveal that someone else is the culprit...

In a statement shared with Decrypt, Bybit emphasized that initial forensics reports show the exchange’s infrastructure “was not compromised” by North Korean hackers.

[bittraffic]

If Zhou can bring the hackers to justice, then more power to him, I take no prisoners when it comes to fraud and to me punishment is what is necessary for such scumbags.

If its true what they say and Lazarus is actually behind this, then chances of him bringing them to justice are slim to none. I mean, they are supposed to be protected/directed by North Korea government, meaning there is nothing they can do other than try to freeze some funds and retrive if possible.

As others have said, Bybit should focus on improving their security instead, as that's something that they can actually do.

Should we really support freezing funds on the Ether network? Because it does look like its going to upset the rest of the institutions backing ETH. Freezing means they could freeze someone else funds if they don't like that someone.

What bybit should do is make sure their security is tougher to hackers that could steal more than them. Until they couldn't say exactly who or provide an evidence they are hacked, I guess it will remain a publicity for Bybit.

[Z-tight]

The Lazarus group is somehow accused of every hack these days, lol, are they the only hackers out there. Hackers are everywhere, all around the world and not only in North Korea, i am sure other hackers would be smiling that fingers are always pointed at the Lazarus group everytime.

I don't think it is possible for bybit to recover all of the stolen funds, even if they offer more millions, they may be lucky to recover a few more of it, but everything is impossible. So they should shift some of the focus to their system and spend more money in preventing another hack in the future.

[Rikafip]

The Lazarus group is somehow accused of every hack these days, lol, are they the only hackers out there.

Yep, it seems kind of improbable that almost all hacks are carried out by the same group. And what if other hacking groups are using similar methods just to make investigators think it was done by Lazarus?

ZachBXT (or whatever his name is) be like this (anyone remembers that crazy ancient aliens guy that suspected aliens did everyhing?)

[examplens]

From everything written, it seems to me that they have declared war on them - but what I wanted to say is that they should work on prevention, not wait for something like this to happen and then try to repair the damage by offering a bunch of money to whoever can save what can be saved.

Besides, who hacked them? First they said it wasn't the NK guys, now they say it was, tomorrow someone will reveal that someone else is the culprit...

In a statement shared with Decrypt, Bybit emphasized that initial forensics reports show the exchange’s infrastructure “was not compromised” by North Korean hackers.

After an investigation, the culprit was found, and of course, it was not Bybit. It's about Safe{Wallet}'s infrastructure.
It doesn't even matter that they didn't protect billions with their UI solution.


https://x.com/benbybit/status/1894768736084885929

[dkbit98]

After an investigation, the culprit was found, and of course, it was not Bybit. It's about Safe{Wallet}'s infrastructure.
It doesn't even matter that they didn't protect billions with their UI solution.

It's interesting that safe wallet is using cloud storage for their infrastructure, so I am not surprised with this happening at all.
Things are getting more heated with this case, latest news I heard is that fbi released official statement with warning about this, and they are asking everyone to block incoming transactions from TraderTraitor actors.
https://www.ic3.gov/PSA/2025/PSA250226

[TryNinja]

So far, we have only seen Mantle freeze $41,917,500 and a few others that have been reported.
There could be many more bounty reports from several sources and Ben is currently collecting them.

ZachXBT managed to get even more frozen, he's just not up to date on the list.

Instead of investing that $140 million in the security of their platform, they are now playing some kind of hero who is throwing money away to do exactly what?

Well, the money is already gone. They have the choice to keep it all lost or give people a chance to help them out for a 10% bounty. Someone helps them freeze $50m, they get 50m-10% = $45 million back on their wallets, quite a "bit" of money. Worth it and an obvious play. You rather they lose 100%?

After an investigation, the culprit was found, and of course, it was not Bybit. It's about Safe{Wallet}'s infrastructure.
It doesn't even matter that they didn't protect billions with their UI solution.

If they're signing a $1.4b transaction on a third party UI hosted on the internet, which can be MITM attacked, they're at definitely dumb and at the fault. Doesn't matter that Safe was the one social engineered.

[avp2306]

The Lazarus group is somehow accused of every hack these days, lol, are they the only hackers out there. Hackers are everywhere, all around the world and not only in North Korea, i am sure other hackers would be smiling that fingers are always pointed at the Lazarus group everytime.

I don't think it is possible for bybit to recover all of the stolen funds, even if they offer more millions, they may be lucky to recover a few more of it, but everything is impossible. So they should shift some of the focus to their system and spend more money in preventing another hack in the future.

Here how they track the attacker https://www.trmlabs.com/post/the-bybit-hack-following-north-koreas-largest-exploit

And Lazarus group is well known for this type of hacking and I don't know how Bybit and authorities will sue this group it seems they are well protected by government since they are bringing huge money from them thru these criminal activities they made.

A brief information about this group https://en.wikipedia.org/wiki/Lazarus_Group

Its really hard to get those funds not unless there are funds still hidden on some exchange since they can freeze its withdrawal.

[Lucius]

Instead of investing that $140 million in the security of their platform, they are now playing some kind of hero who is throwing money away to do exactly what?

Well, the money is already gone. They have the choice to keep it all lost or give people a chance to help them out for a 10% bounty. Someone helps them freeze $50m, they get 50m-10% = $45 million back on their wallets, quite a "bit" of money. Worth it and an obvious play. You rather they lose 100%?
~snip~

I honestly don't feel anything about their loss, because I'm not one of those who keeps coins on CEXs, and consequently I wonder why people still think it's safe? Maybe because that criminal CZ said that 99% of people will lose their coins if they keep them in non-custodial wallets? Some people should not be engaged in such business, the one who was hacked is only one of a series of geniuses who can allow themselves to keep billions in hot wallets.

My comment was directed towards one thought - if by any chance they had invested that money (more/less) in the security of their platform, maybe this hack would not have happened to them.

[TryNinja]

I honestly don't feel anything about their loss, because I'm not one of those who keeps coins on CEXs, and consequently I wonder why people still think it's safe? Maybe because that criminal CZ said that 99% of people will lose their coins if they keep them in non-custodial wallets? Some people should not be engaged in such business, the one who was hacked is only one of a series of geniuses who can allow themselves to keep billions in hot wallets.

My comment was directed towards one thought - if by any chance they had invested that money (more/less) in the security of their platform, maybe this hack would not have happened to them.

In handsight, that's obvious. But I'm sure they thought Safe's multisig was safe and it's not like they were using electrum for desktop on a public computer, they even had hardware wallets. I personally would be extra paranoid for a setup involving $1.4b, but oh well...

The rational now that the hack already happened is: retrieve whatever you can. Why are you guys so angry at them for doing this?