On 21 February 2025, several people at Bybit looked at a transaction on their screens, checked it, and approved it.
They were following procedure. The exchange used a multi-signature wallet, so no one person could move funds alone. More than one signer had to agree, and more than one did. The cryptography behind the whole arrangement was sound, and stayed sound the entire time.
Roughly 401,000 ETH left anyway. About $1.5 billion, the largest cryptocurrency theft ever recorded.
No key was brute-forced. No smart contract was exploited. No multisig threshold was bypassed. Attackers had compromised a developer's machine at Safe{Wallet}, the third-party platform Bybit used to manage that wallet, stolen AWS session tokens, and injected JavaScript that altered the signing interface. The signers looked at a legitimate transaction and approved it. What they actually authorised was something else entirely.
The FBI attributed the theft to TraderTraitor, one of the crews inside North Korea's Lazarus Group, run out of the Reconnaissance General Bureau.
So Bybit's controls were never defeated. They were handed a false picture and then executed against it, flawlessly. And the machine where that picture got corrupted didn't belong to Bybit.
Lazarus operates under a handful of names, which reflects how it's organised rather than any confusion about who it is. APT38, TraderTraitor and BlueNoroff handle the money. Hidden Cobra and Diamond Sleet cover the broader espionage work. One state apparatus, two jobs running at once: steal at scale, and conduct supply-chain and espionage operations for strategic advantage.
The money side has taken over the story. Cumulative DPRK crypto theft now sits around $6.75 billion, roughly $2.02 billion of it during 2025 alone, a 51% jump year on year. Through April 2026, North Korean actors accounted for about three-quarters of all crypto hack value globally. Those aren't opportunistic incidents adding up. It's a state revenue programme with specialisation, tooling pipelines and multi-year planning behind it, funding a weapons programme.
And the way in is nearly always a person.
The campaigns are called Contagious Interview and Operation Dream Job, and the mechanics barely change. A recruiter makes contact, usually on LinkedIn. The role is attractive, the profile looks real, and there's a skills assessment attached: a coding challenge, a take-home task, a trading tool to install. The repository is real. The task is real. Something inside it isn't.
One variant shows how carefully this gets built. Partway through a video interview the candidate's camera appears to fail. An error message explains the problem and offers a command to copy and paste. Forty-five minutes into a call about a job they want, the developer runs it. That's the compromise. The error was fabricated, the fix was malware, and the timing was chosen because that's the point in a recruitment process where someone is least likely to stop and think.
This is running right now. Researchers tied over 1,700 malicious packages across five open-source ecosystems to the campaign between January 2025 and April 2026. A related cluster sent more than 250 emails during April and May 2026 to developers at nearly a hundred organisations in technology, education, finance and crypto, each one pointing at a GitHub or GitLab repository dressed as a coding assignment.
Even the domain names are built for that moment of plausibility. aptiscore. provevidskillcheck. easyhiringtool. evalswift. hiring-one. hiremployee. They read like recruitment tooling because that's the job they're doing.
Three things compound.
The first is that the compromise frequently happens somewhere you have no visibility. In the Bybit chain the laptop belonged to a developer at a vendor. Bybit could have run perfect security across every asset it owned and still lost the money, because the corrupted component arrived through a supplier it had every reason to trust.
The second is that the malware tends to be new. Lazarus builds custom backdoors, Comebacker among them, and leans on DLL side-loading and built-in system binaries to keep the footprint small. Any detection strategy that waits for a known hash is a strategy tuned to their previous campaign.
Third, they're patient in a way that most defensive assumptions don't account for. The April 2026 operations included six months of groundwork, with operators posing as a trading firm and turning up at crypto conferences in person to build genuine working relationships with engineers before anything technical started. Annual awareness training isn't a control against that. It's paperwork.
Putting those together and catching this actor at the moment of theft is close to hopeless, because by then they're using real credentials to do permitted things through infrastructure you already trust.
The transaction is the wrong place to fight. Once a signing interface is lying to your operators, the part of the fight that mattered is already over.
Everything useful happens earlier: on the developer endpoint, in the credential and session layer, in the supply chain, in cloud identity. That's a longer chain than a heist, and the length is the good news. A long chain gives you many places to break it.
Here's how Invinsense 7.0 breaks it.
Nine steps, following the attack in the order it happens. Each one covers what Lazarus does at that point, and what the platform does about it.
What Lazarus does. Research the target thoroughly. Builds or registers recruitment infrastructure with names chosen for plausibility, and pulls together enough real detail about the company and the person to hold a convincing conversation.
What Invinsense does. Attack Surface Monitoring, dark web coverage included, looks at your organisation the way the attacker does. It flags exposed vendor and developer infrastructure and surfaces leaked credentials belonging to your staff and your suppliers, which is often the raw material that makes a recruiter sound credible. The Threat Intelligence Platform pushes validated indicators into blocking positions at DNS, firewall, proxy and EDR, so a known recruitment domain never reaches the developer at all.
What Lazarus does. The developer clones the repository and runs it, or pastes the command from the fake camera error. A postinstall script fires, or a LOLBin fetches the next stage. Nothing on disk is necessarily recognisable, because the build is often fresh.
What Invinsense does. Two detections, both behavioural, neither needing a hash.
The first watches for a package manager spawning a shell or making a network call during install. Run npm install and the postinstall script should be building software, not opening connections or launching command interpreters. UEC, the endpoint agent, plus proxy data, catches that combination. It's narrow, high confidence, and sits directly on the delivery step of the most common Lazarus entry route.
The second covers LOLBin execution: mshta, rundll32, regsvr32 or wscript launching remote or encoded content. These are legitimate Windows programs, which is exactly why they get borrowed. The signal isn't the binary, it's the binary doing something it has no business doing.
What Lazarus does. Goes after what reaches past the machine: credentials in memory, saved browser logins, and session cookies. Cookies matter most, because a live session token walks past the password and the second factor together.
What Invinsense does. UEC and EDR alert when an untrusted process reads LSASS memory, where Windows holds live passwords and tokens. Separately, they catch a non-browser process reading browser login-data or cookie stores. On the identity side, Okta and Microsoft 365 logs feed the SIEM, which flags impossible travel and MFA push spam.
Bybit is the illustration of why this step is the pivot. The tokens taken from that developer machine were cloud session tokens, and cloud session tokens turn one compromised laptop into access to the infrastructure that laptop administers.
What Lazarus does. Installs persistence so a reboot doesn't cost them the access. Comebacker-class backdoors use the documented mechanisms: a new scheduled task, a run key, a new service, DLL side-loading.
What Invinsense does. UEC and Windows event logs drive a detection for any of those pointing at an unsigned or user-writable binary shortly after first execution. The timing correlation is what sharpens it. Software installs create persistence entries all day; software installed ninety seconds ago by a process that spawned out of a coding assignment is a different proposition.
Deception runs underneath. Decoy systems, files and identities sit across the environment belonging to nobody, with no legitimate reason for anyone to approach them. An implant exploring its surroundings eventually brushes one, and that touch is high confidence no matter how carefully the implant was built. AMTD keeps shifting the surface beneath a foothold, so a quiet implant is likely to break or expose itself over time.
What Lazarus does. Works patiently from the first endpoint toward the systems that matter, using stolen developer and operator credentials rather than exploits. Low noise, no urgency.
What Invinsense does. UEBA carries this step. It baselines users, hosts and service accounts, then flags drift: a developer account reaching systems it has never touched, a service account behaving unlike itself, privileged access at hours that account has never worked. Static rules can't catch it, because every individual action is permitted. The deviation is the finding.
In the cloud, CIEM holds identities to least privilege and surfaces entitlement sprawl while CNAPP watches workload and control-plane activity. The value in a Bybit-shaped chain is the join: developer endpoint signal from EDR, cloud session-token and IAM abuse from CIEM and CNAPP, and identity telemetry, all landing as one case instead of three alerts in three consoles that never reference each other.
What Lazarus does. Delivers through trojanized npm or Electron applications, poisoned dependencies, and fake assessment repositories. Or compromises a third party outright and rides the trusted relationship into the real target, which is the Bybit pattern.
What Invinsense does. ASPM and CNAPP, with SBOM, SCA and infrastructure-as-code scanning, surface trojanized packages, tampered dependencies and IaC drift. The LLM Gateway and AI guardrails extend the same logic into AI-assisted development, where a suggested dependency is one more route for something poisoned to arrive wearing a clean face.
The realistic claim here is about your own pipeline. Invinsense tells you when a poisoned component enters your build. It can't instrument a supplier's development environment, which is the first limitation below.
What Lazarus does. Beacons out to freshly registered infrastructure, or hides the channel inside services you already permit: GitHub raw content, Pastebin, Telegram and Discord APIs.
What Invinsense does. Newly-registered-domain beaconing catches steady outbound traffic to domains under roughly thirty days old, using DNS logs and WHOIS enrichment in the SIEM. Lure and C2 infrastructure is typically new, so age alone carries real signal.
Dead-drop C2 detection handles the trusted-service problem, flagging a process pulling configuration from raw.githubusercontent, Pastebin, or messaging APIs. NDR and XDR carry the network side, matching beaconing patterns against the C2 infrastructure in the TI feed.
What Lazarus does. Collects and compresses before moving anything out, then exfiltrates. For financial targets, this is also where the crypto-facing activity appears.
What Invinsense does. Data staging shows up as bulk archive creation across many files in a short window on a sensitive host, caught through UEC and file telemetry. Crypto-API egress detection flags connections to exchange or custody APIs from assets that should never touch them, which works only as well as your asset tagging does. EDR covers wallet-file and clipboard access on managed endpoints, and NDR and UEBA cover unusual outbound transfers to crypto infrastructure.
Alongside this, Lazarus tampers with security tooling and clears logs. UEC and event logs feed detections for attempts to stop security services or wipe Security and PowerShell logs, and for masquerading, where a process carrying a system name runs from a non-system path. Log clearing earns its severity for a simple reason: nothing legitimate does it.
What Invinsense does. On confirmation, SOAR playbooks isolate the host and revoke credentials and sessions automatically, then sweep the organisation for the associated indicators. Everything runs through case management, and a confirmed intrusion can pull in the DFIR retainer team.
The retrospective piece gets less attention than it deserves. Because log data is retained and archived, a newly published indicator can be run backwards over historical telemetry. When a report lands in February naming infrastructure that was live the previous September, the question worth answering is whether that infrastructure appeared in your environment during the months in between. Against an adversary whose entire method is patience, asking a new question of old data is frequently how the foothold turns up.
None of these detections needs to know the actor is Lazarus, and none depends on a hash published last week. Each fires on something that has to happen for the attack to work: code executing where it shouldn't, credentials read by the wrong process, a foothold established, an account reaching past its normal range, data leaving.
Any one of them, alone, is arguable. A developer account touching an unfamiliar system might be a developer doing something new. Assembled in order, with timing attached, the same signals stop being deniable.
You can't instruct someone else's developer. The Bybit chain started on a machine belonging to a vendor. If that vendor isn't running detection on their own developer endpoints, nothing in your environment observes the compromise happening. What you get is a later opportunity: the tampered artefact arriving in your pipeline, the anomalous session in your cloud, the odd approval in your workflow. Those are real and worth having, but they're all downstream of the event itself. Vendor security requirements and supply-chain assurance are doing work here that no product substitutes for.
This isn't blockchain analytics. Invinsense doesn't trace funds on-chain. It covers the activity around a theft: connections to known laundering infrastructure from the TI feed, wallet-file and clipboard access on managed endpoints, unusual outbound transfers, unauthorised mining on workloads. On-chain fund tracing needs a dedicated chain-analytics tool alongside it.
The lure lands on a person. Everything above catches the consequences of a successful approach. The approach itself is a conversation conducted over weeks, sometimes with in-person contact at industry events, and a SIEM rule has nothing to say about it. Developer-specific awareness training, verification procedures for unsolicited technical tasks, and isolated environments for running untrusted code are the controls that operate at that layer.
Indicator feeds age. The domains and hashes in any threat report describe infrastructure that was live at a moment in time, and Lazarus rotates. Indicators are the fast, cheap layer, genuinely useful and especially so in retrospect. The behavioural detections are what still work against the campaign nobody has published yet.
Nobody involved did anything obviously wrong. The wallet was multi-signature. The signers checked. The procedure was followed. The cryptography was held from start to finish.
What failed was the integrity of the picture those people were looking at, and that picture had been corrupted weeks earlier on a laptop at another company, by somebody who got there through a job offer.
That's what Lazarus has industrialised. Not the breaking of controls, but arriving upstream of them, at the developer, at the vendor, at the dependency, then letting your own working systems complete the transaction on their behalf.
If you run anything that signs, approves, or releases value, it's worth knowing which vendors sit inside that path, whether anyone is watching their engineers' machines, and how you'd find out if the answer turned out to be nobody.
Discover complete cybersecurity expertise you can trust and prove you made the right choice!
