Lazarus Group just connected the Bybit hack to the Phemex hack directly on-chain commingling funds from the intial theft address for both incidents.
Overlap address:
0x33d057af74779925c4b2e720a820387cb89f8f65
Bybit hack txns on Feb 22, 2025:
0xc963e65b9ec39b11076f78990c31f29aaa80705c75312dafd1748479e3e94ed0
0x411374feedcfa560335f00c0fcfa0a3906fdcc33687e6f924dd78ebecc45cd00
Phemex hack txns on Feb 20, 2025:
0x6262a3339842240aeebae4ebfe338dbc771aa0e2df8f5a1ebcd7f9b090bedfe3
Before this activity was observed just now myself and Josh from CF found the Bybit testing addresses connected to laundering on Tron for the Phemex hack along with other indicators shared,to earn a bounty from Arkham 12 hrs ago.
Arkham@arkham
Feb 21
View on Twitter
BREAKING: BYBIT $1 BILLION HACK BOUNTY SOLVED BY ZACHXBT
At 19:09 UTC today, @ZachXBT submitted definitive proof that this attack on Bybit was performed by the LAZARUS GROUP.
His submission included a detailed analysis of test transactions and connected wallets used ahead of the exploit, as well as multiple forensics graphs and timing analyses.
The submission has been shared with the Bybit team in support of their investigation. We wish them all the best.
Lazarus Group just linked an address tied to the BingX hack to this same cluster a few minutes ago which now connects the Bybit, BingX, & Phemex hacks on-chain.
Overlap
0xd555789b146256253cd4540da28dcff6e44f6e50
Bybit hack txn: 0x4a366130118d750715c2d35fdc07509cf943fcc988fa5e6d02211e3d5472796e
BingX hack txn:
0x93424aa87731bb9b1d8cc1f708d2ac9f3faf914f368a00494d87cba3e7719e8c
Missing some tweets in this thread? Or failed to load images or videos? You can try to .