Cryptocurrency exchange Bybit has launched a bounty program following a massive $1.5 billion theft of Ethereum by suspected North Korean hackers, identified as the Lazarus Group. The heist, now considered the largest crypto theft in history, involved manipulating a smart contract during a transfer from Bybit’s cold wallet to a hot wallet. This sophisticated attack altered the smart contract logic and signing interface, allowing the attackers to redirect over 400,000 ETH to an unidentified address. Bybit’s CEO, Ben Zhou, announced the “lazarusbounty.com” program, offering rewards for information leading to the recovery of stolen funds. Participants can earn 5% of the recovered crypto, with a total bounty pool of about $140 million. Bybit insists it remains liquid and customer accounts are unaffected, despite the theft. The heist was executed by compromising a developer’s device at the multisig wallet platform SafeWallet, used by Bybit. Forensic analysis revealed the attack stemmed from SafeWallet’s infrastructure. Malicious JavaScript was injected into the SafeWallet platform, activating only under certain conditions to avoid detection. The attackers exploited a potential leak or compromise of SafeWallet’s AWS S3 or CloudFront account. Following the incident, SafeWallet implemented a phased rollout to restore services on the Ethereum mainnet, temporarily removing Ledger integration and enhancing security measures. The SafeWallet team has rebuilt and reconfigured infrastructure, rotating all credentials to prevent future attacks. Investigations confirmed links between the Bybit hackers and the Lazarus Group, noting substantial overlaps with previous North Korean thefts. The stolen funds were traced to addresses linked to hacks on Phemex, BingX, and Poloniex, with efforts to obscure the money trail. Chainalysis reported North Korean hackers stole $1.34 billion in 47 crypto heists in 2024 alone, with total thefts exceeding $6 billion since 2017, allegedly funding the country’s ballistic missile program.