Greece Makes First Crypto Seizure Tied to North Korea's $1.5B Bybit Hack

Greek authorities have carried out the country’s first cryptocurrency seizure, blocking access to funds lifted from February’s record $1.5 billion Bybit hack linked to North Korea’s Lazarus Group.

The Hellenic Anti‑Money Laundering Authority traced a suspicious transaction to a wallet that on‑chain data tied to the initial theft. That wallet, according to Greece’s Minister of Economy and Finance Kyriakos Pierrakakis, was tied to a “Greek platform providing exchange services.”

Analysts, according to a blog post, used Chainalysis Reactor to map the flow of funds to establish “a definitive connection between the cryptocurrency in the suspect user’s wallet and the primary wallets used in the Bybit hack,” the post adds.

The evidence allowed the agency to issue a freezing order, locking the assets before they could disappear. Per Pierrakakis, the Hellenic Anti-Money Laundering Authority’s operations have allowed for around 10 million euros ($11.7 million) to be retuned to victims. It’s unclear whether any of these returns are related to the recent seizure.

The hackers have in the past moved funds through mixers such as Wasabi and Tornado Cash, cross‑chain bridges and peer‑to‑peer desks.

Bybit’s public LazarusBounty dashboard suggests that about $72 million, 5% of the stolen ether, has now been frozen, while a third remains traceable. Around $870 million stolen from Bybit have now “gone dark,” according to the dashboard.