Marketplace Fraud Analysis

Lazarus Group just connected the Bybit hack to the Phemex hack directly on-chain commingling funds from the intial theft address for both incidents. Overlap address: 0x33d057af74779925c4b2e720a820387cb89f8f65 Bybit hack txns on Feb 22, 2025: 0xc963e65b9ec39b11076f78990c31f29aaa80705c75312dafd1748479e3e94ed0 0x411374feedcfa560335f00c0fcfa0a3906fdcc33687e6f924dd78ebecc45cd00 Phemex hack txns on Feb 20, 2025: 0x6262a3339842240aeebae4ebfe338dbc771aa0e2df8f5a1ebcd7f9b090bedfe3

Before this activity was observed just now myself and Josh from CF found the Bybit testing addresses connected to laundering on Tron for the Phemex hack along with other indicators shared,to earn a bounty from Arkham 12 hrs ago. definitive proof that this attack on Bybit was performed by the LAZARUS GROUP. detailed analysis of test transactions and connected wallets used ahead of the exploit, as well as multiple forensics graphs and timing analyses. The submission has been shared with the Bybit team in support of their investigation. We wish them all the best.

Lazarus Group just linked an address tied to the BingX hack to this same cluster a few minutes ago which now connects the Bybit, BingX, & Phemex hacks on-chain. Overlap 0xd555789b146256253cd4540da28dcff6e44f6e50 Bybit hack txn: 0x4a366130118d750715c2d35fdc07509cf943fcc988fa5e6d02211e3d5472796e BingX hack txn: 0x93424aa87731bb9b1d8cc1f708d2ac9f3faf914f368a00494d87cba3e7719e8c

I spent the entire day graphing out the laundering movements and flagged theft addresses, tracing 920+ addresses connected to the Bybit hack.

Today when laundering funds for the Bybit Hack the Poloniex hack was also linked on-chain in consolidation address 0x15ec. This now shows the same entity is tied to four different hacks (Bybit, Poloniex, Phemex, BingX) Overlap 0x15ec300a4895a86322f1a27dd9ba0b9f8297e65d Bybit Hack 0x83c7678492d623fb98834f0fbcb2e7b7f5af8950 0x96244d83dc15d36847c35209bbdc5bdde9bec3d8 Poloniex Hack 0xa0495b9421b0e81479b5271a041c9f28fc555800