Two weeks ago at the DeFi Security Summit, Trail of Bits’ Josselin Feist (@Montyly) was asked if we’d see a billion-dollar exploit in 2025. His response: “If it happens, it won’t be a smart contract, it’ll be an operational security issue.”

Today, that prediction was validated.

The Attack

On February 21, 2025, cryptocurrency exchange Bybit suffered the largest cryptocurrency theft in history when attackers stole approximately $1.5B from their multisig cold storage wallet. At this time, it appears the attackers compromised multiple signers’ devices, manipulated what signers saw in their wallet interface, and collected the required signatures while the signers believed they were conducting routine transactions.

This hack is one of many that represent a dramatic shift in how centralized exchanges are compromised. For years, the industry has focused on hardening code and improving their technical security practices, but as the ecosystem’s secure development life cycle has matured, attackers have shifted to targeting the human and operational elements of cryptocurrency exchanges and other organizations.

These attacks reveal an escalating pattern, with each compromise building on the last:

In each case, the attackers didn’t exploit smart contract or application-level vulnerabilities. Instead, they compromised the computers used to manage those systems using sophisticated malware to manipulate what users saw versus what they actually signed.

The DPRK’s Cryptocurrency Theft Infrastructure

These hacks are not isolated incidents. According to Arkham Intelligence, famed researcher ZachXBT has provided definitive proof linking this attack to North Korea, including detailed analysis of test transactions and connected wallets used ahead of the exploit. These incidents represent the maturation of sophisticated attack capabilities developed by North Korean state-sponsored threat actors, specifically groups tracked as TraderTraitor, Jade Sleet, UNC4899, and Slow Pisces under the DPRK’s Reconnaissance General Bureau (RGB).

Figure 1: Organizational structure of DPRK cyber threat actors under the Reconnaissance General Bureau (RGB). This chart shows the relationship between different threat groups and their various industry designations. Source: Palo Alto Networks Unit 42, September 2024
Figure 1: Organizational structure of DPRK cyber threat actors under the Reconnaissance General Bureau (RGB). This chart shows the relationship between different threat groups and their various industry designations. Source: Palo Alto Networks Unit 42, September 2024

The attack chain typically begins with aggressive social engineering campaigns targeting multiple employees simultaneously within an organization. The RGB identifies key personnel in system administration, software development, and treasury roles, then creates detailed pretexts – often elaborate job recruitment schemes – customized to each target’s background and interests. These aren’t mass phishing campaigns; they’re meticulously crafted approaches designed to compromise specific individuals with access to critical systems.

What makes these attacks particularly concerning is their repeatability. The RGB has built a sophisticated cross-platform toolkit that can:

  • Operate seamlessly across Window