Greece Makes First Crypto Seizure After $1.5 Billion Bybit Hack – Here’s What Happened

Hellenic Anti-Money Laundering Authority in Greece achieved the country’s first-ever cryptocurrency asset freezing, recovering funds directly linked to the $1.5 billion Bybit exchange hack attributed to North Korea’s Lazarus Group.

The landmark operation utilized Chainalysis Reactor blockchain analysis tools to trace stolen funds through complex laundering schemes.

The analysis establishes irrefutable on-chain evidence that connects seized assets to the February 2025 cyber heist.

In our latest blog, we look at how the Hellenic Anti-Money Laundering Authority, with help from Chainalysis, traced and froze a portion of the funds from the Bybit hack, marking the first-ever crypto seizure in Greece: https://t.co/SOXmT9xknN

The investigation began when authorities spotted a suspicious crypto transaction months after the Bybit attack.

Using advanced blockchain analysis capabilities acquired in 2023, Greek investigators visualized fund flows and definitively linked cryptocurrency in a suspect wallet to primary wallets used in the exchange breach.

The coordinated international response comes as 32.78% of the stolen $1.4 billion remained traceable nearly five months after the attack, with a massive 62.04% having gone dark and 5.18% successfully frozen.

Greece’s success stemmed from strategic preparation, with the Hellenic Authority investing in Chainalysis Reactor capabilities through its regional partner, Performance Technologies, in 2023.

The blockchain analysis revealed that North Korean hackers immediately laundered the stolen Ethereum through intricate transaction webs designed to obscure the money trail.

Chainalysis confirmed the initial compromise occurred via social engineering, with attackers executing phishing attacks against cold wallet signers to manipulate multi-signature implementations.

Bybit CEO Zhou described the devastating moment he learned of the breach, initially believing 30,000 ETH worth $82 million was affected before discovering all 401,000 ETH ($1.4 billion) had vanished.

The exchange processed 350,000 withdrawal requests within 10 hours and 580,000 by Saturday, maintaining operations to preserve customer confidence.

Security analysts confirmed the Lazarus Group moved funds rapidly through decentralized exchanges, mixers, and cross-chain bridges to evade tracking.

BYBIT HACKER LAUNDERING FUNDS

The Bybit Hacker is making 2-3 transactions per minute, and stops every 45 minutes for a 15 minute break. They move ETH from one address at a time, before moving onto the next one.

Did Lazarus get an intern to wash their funds manually? pic.twitter.com/XCS16hMC3i

The cybercriminals converted 86.29% of stolen funds into 12,836 Bitcoin distributed across 9,117 wallets, primarily using Wasabi, CryptoMixer, Railgun, and Tornado Cash for obfuscation.

As Greece took a step, Germany has taken its own significant action, seizing €34 million ($38 million) in crypto from the eXch platform on May 8 as part of ongoing investigations into the Bybit hack money laundering.

The seizure marked the third-largest crypto confiscation in the history of the German Federal Criminal Police Office, effectively shutting down the privacy-centric swapping service.

German authorities dismantled eXch after determining that the platform had laundered over €1.75 billion ($1.9 billion) in cryptocurrency, with a significant portion suspected to have originated from criminal activities.

The investigation revealed eXch ignored repeated warnings, refused to block malicious addresses, and failed to comply with regulatory freeze orders.

ZachXBT confirmed eXch processed funds from multiple high-profile incidents, including multisig wallet exploits, the $243 million Genesis creditor heist, and numerous phishing operations.

The platform marketed itself as privacy-centric, offering cross-blockchain exchanges without identity verification or anti-money laundering compliance.

Despite claiming a shutdown in April, eXch continued operations through backend APIs while websites went offline.

TRM Labs revealed that the platform never truly ceased functioning, allowing criminal groups, including Lazarus, to continue laundering activities through signature mixing pools that obscured the origins of the funds.

Despite shutdown claims, crypto mixer eXch still launders illicit funds via active API, linked to Bybit hack and CSAM funding, warns @trmlabs.#CryptoCrime #CryptoMixerhttps://t.co/DQBOEYPnR3

As it stands now, recovery efforts united 12 organizations, including Mantle, Paraswap, and blockchain investigators, earning bounty hunters $2.2 million USDT for assistance.

Despite these efforts, organized crime remains a significant threat to the cryptocurrency industry.

Between June and July, Taiwan’s BitoPro has lost $11.5 million through exposed wallets during system upgrades, and Brazil’s C&M Software attack resulted in $40 million crypto laundering.

Most significantly, Iran’s largest cryptocurrency exchange, Nobitex, confirmed a $73 million security breach on June 19, with unauthorized access detected in its hot wallet infrastructure, which subsequently resulted in over $90 million being drained.

Suspected exploit hits GMX — over $42M drained from vaults and bridged from Arbitrum to Ethereum, reports DeBank.#GMXi #Exploit https://t.co/1rKj0uE1br

In fact, just today, the decentralized exchange GMX is believed to have suffered a $42 million exploit, with digital assets reportedly drained from its vaults.

For Bybit, the exchange has launched a bounty program offering 10% rewards on recovered funds, totaling up to $140 million for successful asset retrieval.

The post Greece Makes First Crypto Seizure After $1.5 Billion Bybit Hack – Here’s What Happened appeared first on Cryptonews.