Share this article

Greece Makes First Crypto Seizure Tied to North Korea's $1.5B Bybit Hack

The Hellenic Anti-Money Laundering Authority issued a freezing order, locking the assets and preventing them from being transferred.

Jul 9, 2025, 6:03 p.m.
Bybit lost roughly $1.5 billion in crypto to a theft Friday. (appshunter.io/Unsplash)
(appshunter.io/Unsplash)

What to know:

  • Greek authorities said they have carried out the country's first cryptocurrency seizure, freezing funds linked to the $1.5 billion Bybit hack.
  • The Hellenic Anti-Money Laundering Authority issued a freezing order, locking the assets and preventing them from being transferred.
  • The seizure is part of a broader effort to recover stolen funds, with around $72 million (5% of the stolen ether) frozen and $870 million now unaccounted for.

Greek authorities have carried out the country’s first cryptocurrency seizure, blocking access to funds lifted from February’s record $1.5 billion Bybit hack linked to North Korea’s Lazarus Group.

The Hellenic Anti‑Money Laundering Authority traced a suspicious transaction to a wallet that on‑chain data tied to the initial theft. That wallet, according to Greece’s Minister of Economy and Finance Kyriakos Pierrakakis, was tied to a “Greek platform providing exchange services.”

STORY CONTINUES BELOW
Don't miss another story.Subscribe to the Crypto Daybook Americas Newsletter today. See all newsletters

Analysts, according to a blog post, used Chainalysis Reactor to map the flow of funds to establish “a definitive connection between the cryptocurrency in the suspect user’s wallet and the primary wallets used in the Bybit hack,” the post adds.

The evidence allowed the agency to issue a freezing order, locking the assets before they could disappear. Per Pierrakakis, the Hellenic Anti-Money Laundering Authority’s operations have allowed for around 10 million euros ($11.7 million) to be retuned to victims. It’s unclear whether any of these returns are related to the recent seizure.

The hackers have in the past moved funds through mixers such as Wasabi and Tornado Cash, cross‑chain bridges and peer‑to‑peer desks.

Bybit’s public LazarusBounty dashboard suggests that about $72 million, 5% of the stolen ether, has now been frozen, while a third remains traceable. Around $870 million stolen from Bybit have now “gone dark,” according to the dashboard.

More For You

Protocol Research: GoPlus Security

GP Basic Image

What to know:

  • As of October 2025, GoPlus has generated $4.7M in total revenue across its product lines. The GoPlus App is the primary revenue driver, contributing $2.5M (approx. 53%), followed by the SafeToken Protocol at $1.7M.
  • GoPlus Intelligence's Token Security API averaged 717 million monthly calls year-to-date in 2025 , with a peak of nearly 1 billion calls in February 2025. Total blockchain-level requests, including transaction simulations, averaged an additional 350 million per month.
  • Since its January 2025 launch , the $GPS token has registered over $5B in total spot volume and $10B in derivatives volume in 2025. Monthly spot volume peaked in March 2025 at over $1.1B , while derivatives volume peaked the same month at over $4B.

More For You

French Banking Giant BPCE to Roll Out Crypto Trading for 2M Retail Clients

(CoinDesk)

The service will allow customers to buy and sell BTC, ETH, SOL, and USDC through a separate digital asset account managed by Hexarq.

What to know:

  • French banking group BPCE will start offering crypto trading services to 2 million retail customers through its Banque Populaire and Caisse d’Épargne apps, with plans to expand to 12 million customers by 2026.
  • The service will allow customers to buy and sell BTC, ETH, SOL, and USDC through a separate digital asset account managed by Hexarq, with a €2.99 monthly fee and 1.5% transaction commission.
  • The move follows similar initiatives by other European banks, such as BBVA, Santander, and Raiffeisen Bank, which have already started offering crypto trading services to their customers.