Key Takeaways
- • Bybit, a Dubai-based crypto exchange, facilitated approximately $2 billion in illicit financial flows connected to Iran, despite explicitly prohibiting Iranian service accounts on its platform.
- • North Korean state-sponsored hackers linked to the Lazarus Group executed the largest crypto exchange hack on record on February 21, 2025, stealing $1.5 billion in ether from Bybit, with North Korean cyber actors stealing over $2 billion in total crypto assets during 2025.
- • Attackers converted roughly $500 million of stolen ether into Tether (USDT), a dollar-pegged stablecoin, to facilitate fund transfers and circumvent asset freezes before routing proceeds to Iran-linked entities.
- • The scheme demonstrates how sanctioned nations leverage cryptocurrency infrastructure to bypass US financial sanctions and access conventional financial system alternatives, creating a "digital financial underground" connecting state-sponsored cybercriminals and sanctions-evading regimes.
- • The incident underscores compliance and enforcement gaps at major crypto platforms, as Bybit became a transit point for illicit Iranian funds despite explicit policy restrictions against Iranian access.
Summary
On February 21, 2025, hackers affiliated with North Korea's Lazarus Group executed the largest single cryptocurrency exchange hack ever recorded, stealing $1.5 billion in ether from Bybit, a Dubai-based crypto exchange. The FBI and blockchain analytics firm Chainalysis both attributed the attack to Lazarus, a state-sponsored hacking unit that has systematized cybercrime as a revenue-generation mechanism for the North Korean government. This heist represented the bulk of over $2 billion in total cryptocurrency stolen by North Korean hackers throughout 2025, according to reporting by the Wall Street Journal.
The theft evolved into something more operationally significant than a simple heist: it became a blueprint for illicit cross-border finance. Following the initial theft, attackers converted approximately $500 million of the stolen ether into Tether (USDT), a dollar-pegged stablecoin, to facilitate easier movement and reduce the risk of asset freezes. The stolen and converted funds subsequently flowed through Bybit and were ultimately routed to Iranian entities seeking to circumvent decades of US sanctions that have isolated Iran from conventional financial infrastructure.
The Iranian connection reveals a critical compliance gap at Bybit. Despite explicitly prohibiting service to Iran in its terms of service, the exchange became a transit point for substantial illicit flows benefiting Iranian actors. The $2 billion figure tied to Iran represents a significant portion of broader cryptocurrency crime losses—the industry witnessed over $3.4 billion in total theft between January and early December 2025, with the Bybit compromise accounting for a material share. The incident illustrates how sanctioned nations leverage cryptocurrency platforms and stablecoins as workarounds to access financial services and move capital while avoiding traditional banking system restrictions.
This case underscores the ongoing tension between cryptocurrency exchange compliance frameworks and the reality of enforcement across decentralized networks. While major platforms maintain explicit sanctions policies, the speed and opacity of blockchain transactions create windows for illicit activity. The convergence of North Korean state-sponsored cybercrime and Iranian sanctions evasion on a single platform highlights the emerging infrastructure connecting multiple bad actors—from nation-state hackers to sanctioned regimes—within the cryptocurrency ecosystem.
The theft evolved into something more operationally significant than a simple heist: it became a blueprint for illicit cross-border finance. Following the initial theft, attackers converted approximately $500 million of the stolen ether into Tether (USDT), a dollar-pegged stablecoin, to facilitate easier movement and reduce the risk of asset freezes. The stolen and converted funds subsequently flowed through Bybit and were ultimately routed to Iranian entities seeking to circumvent decades of US sanctions that have isolated Iran from conventional financial infrastructure.
The Iranian connection reveals a critical compliance gap at Bybit. Despite explicitly prohibiting service to Iran in its terms of service, the exchange became a transit point for substantial illicit flows benefiting Iranian actors. The $2 billion figure tied to Iran represents a significant portion of broader cryptocurrency crime losses—the industry witnessed over $3.4 billion in total theft between January and early December 2025, with the Bybit compromise accounting for a material share. The incident illustrates how sanctioned nations leverage cryptocurrency platforms and stablecoins as workarounds to access financial services and move capital while avoiding traditional banking system restrictions.
This case underscores the ongoing tension between cryptocurrency exchange compliance frameworks and the reality of enforcement across decentralized networks. While major platforms maintain explicit sanctions policies, the speed and opacity of blockchain transactions create windows for illicit activity. The convergence of North Korean state-sponsored cybercrime and Iranian sanctions evasion on a single platform highlights the emerging infrastructure connecting multiple bad actors—from nation-state hackers to sanctioned regimes—within the cryptocurrency ecosystem.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.