Back Cryptobriefing

$2B Bybit hack linked to North Korea, Iran involvement unconfirmed

Cryptobriefing • June 25, 2026

Investigators have reportedly linked $1.5 billion in hack funds to the Bybit cryptocurrency exchange exploit, with connections drawn to North Korea and Iran. This exploit, which occurred in February 2025, involved the theft of approximately 401,000 ETH and 90,375 stETH from Bybit’s cold wallet infrastructure. The FBI has previously attributed the attack specifically to North Korea’s Lazarus Group, particularly the TraderTraitor subgroup. Despite the original report’s mention of Iran, no credible public sources have confirmed Iran’s involvement in this specific exploit. The revelation could have significant implications for the cryptocurrency market, suggesting heightened concerns over security breaches.

Monitoring the response from Bybit and any further clarifications from investigative bodies such as the FBI will be crucial. Any additional confirmation or denial regarding Iran’s involvement could impact market perceptions. Key figures in the cybersecurity and crypto exchange sectors, including Richard Teng and Lei Yang, may provide insights or statements that influence market expectations. Watch for updates on recovery efforts and any sanctions or regulatory actions that may follow.

Get prediction market intelligence as a structured API feed. Early access waitlist .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Crypto Sector Suffers $68.3M Losses from Scams in May 2026 In May 2026, the cryptocurrency industry experienced losses totaling approximately $68.3 million due to scams and exploits, marking a significant decline of nearly 90% from April's $650 million. The losses stemmed from 60 confirmed incidents, with phishing attacks accounting for about $2.6 million. Major incidents included the Verus Protocol attack, which resulted in $11.5 million lost, and THORChain, which lost $10.1 million. The report from CertiK indicates that while large-scale attacks have decreased, risks from phishing and credential leaks are on the rise. Funds recovered during this period amounted to $9.4 million, representing about 13.7% of the total losses. The data highlights a shift in attack vectors, with code vulnerabilities being the primary target. This trend reflects a broader concern about the security landscape in the crypto sector. 76 sources 52

Extracted Entities

$2B Bybit hack linked to North Korea, Iran involvement unconfirmed

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Companies (1)

Countries (2)

Malware (1)