The Hellenic Anti-Money Laundering Authority in Greece recently achieved a significant milestone by executing the country’s first-ever cryptocurrency asset freezing, successfully recovering funds directly tied to the $1.5 billion Bybit exchange hack, which has been linked to North Korea’s Lazarus Group.
This groundbreaking operation was made possible through the utilization of Chainalysis Reactor blockchain analysis tools, which enabled investigators to trace the stolen funds through intricate laundering schemes. The analysis provided undeniable on-chain evidence connecting the seized assets to the February 2025 cyber heist.
The investigation was initiated when authorities identified a suspicious crypto transaction months after the Bybit attack. Leveraging advanced blockchain analysis capabilities acquired in 2023, Greek investigators were able to visualize fund flows and definitively link cryptocurrency in a suspect wallet to primary wallets used in the exchange breach.
The coordinated international response was successful in tracing 32.78% of the stolen $1.4 billion nearly five months after the attack, with a significant 62.04% of the funds having gone dark and 5.18% successfully frozen.
The success of Greece’s efforts can be attributed to strategic preparation, with the Hellenic Authority investing in Chainalysis Reactor capabilities through its regional partner, Performance Technologies, in 2023. The blockchain analysis revealed that North Korean hackers had laundered the stolen Ethereum through complex transaction webs designed to obfuscate the money trail.
As Greece made significant strides in combating cryptocurrency-related crime, Germany also took decisive action by seizing €34 million ($38 million) in crypto from the eXch platform on May 8 as part of ongoing investigations into the Bybit hack money laundering. This marked the third-largest crypto confiscation in the history of the German Federal Criminal Police Office, effectively shutting down the privacy-centric swapping service.
The investigation into eXch revealed that the platform had laundered over €1.75 billion ($1.9 billion) in cryptocurrency, with a significant portion suspected to have originated from criminal activities. Despite claiming a shutdown in April, eXch continued operations through backend APIs, allowing criminal groups, including Lazarus, to continue laundering activities.
Recovery efforts have united various organizations, including Mantle, Paraswap, and blockchain investigators, with bounty hunters earning $2.2 million USDT for their assistance. Despite these efforts, organized crime remains a significant threat to the cryptocurrency industry, with recent incidents of security breaches and exploits causing substantial losses.
In response to the Bybit hack, the exchange has launched a bounty program offering 10% rewards on recovered funds, with a total reward pool of up to $140 million for successful asset retrieval. The collaboration between international law enforcement agencies and blockchain analysis firms underscores the importance of cooperation in combating cryptocurrency-related crime and ensuring the security of digital assets.