North Korea? ZachXBT says an “organization” is behind Bybit’s hack

On-chain sleuth ZachXBT has submitted to Arkham Intelligence’s bounty request to uncover Bybit’s hacker. ZachXBT claims an “organization” is possibly behind the $1.4 billion attack today, not a single entity as some had thought. 

“My submission has been sent identifying the organization behind the attack using on-chain data,” ZachXBT posted.

My submission has been sent identifying the organization behind the attack using on-chain data.

— ZachXBT (@zachxbt) February 21, 2025

Arkham put out a 50K ARKM bounty, worth slightly over $30,000 at current prices, inviting intel submissions to uncover the attackers. It said the submissions will be shared with the Bybit team to support their investigation.

Someone commented that “50k Arkham is poor for such an incident like this.” However, ZachXBT responded, saying “Nah doesn’t help as much to know who it is when it’s a nation state threat actor.”

ZachXBT’s comment spurred notions that North Korean hackers could be behind Bybit’s hack. Conor Grogan, Head of Product at Coinbase, also thinks North Korean hackers are most likely behind the attack. 

“The Bybit hacker (Most likely N.K. ) is now the 14th largest ETH holder in the world,” Grogan posted.

The Bybit hacker (Most likely N.K. ) is now the 14th largest ETH holder in the world

They hold roughly 0.42% of total supply, more than Fidelity, Vitalik, and 2x +what the Ethereum Foundation holds pic.twitter.com/ZMGY2Bx1B3

— Conor (@jconorgrogan) February 21, 2025