Greek Authorities Strike Back: First Crypto Seizure Linked to North Korea’s Biggest Hack
A Historic Crypto Seizure in Greece
In a major breakthrough for international crypto crime enforcement, Greek authorities have made their first-ever cryptocurrency seizure, freezing assets linked to the massive $1.5 billion Bybit hack in February 2025. This cyberattack was attributed to North Korea’s infamous Lazarus Group, a state-sponsored hacking collective known for targeting global financial systems.
The stolen funds had been moving through complex laundering paths across wallets, bridges, mixers, and exchanges—until investigators in Greece caught a break.
How Greece Traced the Hackers’ Funds
Suspicious Wallet Activity Triggers Investigation
The Hellenic Anti-Money Laundering Authority launched an investigation after spotting suspicious activity tied to a wallet using a Greek exchange platform. On-chain data and advanced blockchain analytics tools quickly confirmed that this wallet had received a portion of the stolen funds from the Bybit breach.
This wasn’t just a fluke detection—it was backed by Chainalysis Reactor, a leading blockchain investigation software used by law enforcement worldwide.
Chainalysis Maps the Flow of Stolen Crypto
According to analysts, Chainalysis helped authorities track the flow of funds from Lazarus-controlled wallets to a Greek user’s wallet, providing a “definitive connection” to the original Bybit hack. This evidence gave authorities the legal basis to issue a freezing order and block access to the assets.
The frozen amount hasn’t been publicly confirmed, but Greek Finance Minister Kyriakos Pierrakakis emphasized the importance of the operation, marking it as a first-of-its-kind milestone for the country.
Background – What Happened in the Bybit Hack
Lazarus Group and the $1.5 Billion Heist
In February 2025, crypto exchange Bybit suffered one of the largest cryptocurrency thefts in history—a $1.5 billion exploit. The attack was quickly linked to Lazarus Group, known for past attacks on Axie Infinity’s Ronin bridge and other major DeFi exploits.
The hackers used advanced laundering techniques, including:
-
Mixers like Wasabi and Tornado Cash
-
Cross-chain bridges to move between blockchains
-
Peer-to-peer (P2P) exchanges and darknet tools
This made it incredibly difficult to trace funds—until Greece stepped in.
LazarusBounty Dashboard Tracks Progress
Bybit set up a public tracker called LazarusBounty, which monitors the status of the stolen crypto. Here’s what it shows as of now:
-
$72 million (5%) of the stolen ETH has been frozen
-
$870 million worth has “gone dark”, meaning it’s no longer traceable
-
One-third of the stolen funds remain traceable, offering hope for more recoveries
Greek Authorities Return Millions to Victims
€10 Million Recovered So Far
Greek Finance Minister Pierrakakis confirmed that, through broader anti-money laundering operations, the Hellenic AML Authority has helped return €10 million (approx. $11.7 million) to victims of various financial crimes. It’s unclear how much of this amount is related to the Bybit hack, but the recent seizure marks a direct step toward recovering stolen crypto.
This operation puts Greece on the map in the global fight against cybercrime, especially crypto-based financial attacks originating from hostile nations like North Korea.
The Bigger Picture – Crypto Crime and Global Security
Lazarus Group: North Korea’s Digital Army
The Lazarus Group is not just any hacking outfit. It is allegedly run by North Korea’s military intelligence, using cybercrime to fund weapons programs and bypass international sanctions.
Their cyberattacks are no longer just technical challenges—they’re considered global security threats. Stolen funds are often funneled into nuclear weapons development, making every recovery effort high-stakes.
The Role of Mixers, Bridges, and P2P Desks
Crypto laundering typically involves tools designed to obscure the origin of funds:
-
Tornado Cash and Wasabi Wallet: These mixers make it harder to trace coins by blending transactions.
-
Cross-chain bridges: Allow easy movement of assets across blockchains, increasing anonymity.
-
Peer-to-peer trading desks: Reduce the need for KYC verification, making it easier to offload laundered crypto.
Despite these methods, blockchain transparency is helping law enforcement win battles, especially when paired with tools like Chainalysis and international cooperation.
What This Means for the Future
Crypto Seizures May Become More Common
As nations build up expertise in blockchain forensics, seizures like this one in Greece may become routine. The global financial system is now intertwined with crypto, and states can no longer ignore that fact.
Expect more collaborations between:
-
National anti-money laundering agencies
-
Cybersecurity firms
-
Blockchain analytics platforms like Chainalysis
Legal Clarity Still Needed
While this operation was a success, many countries still lack clear frameworks for:
-
Freezing crypto wallets
-
Prosecuting cross-border hacks
-
Handling return of crypto assets to victims
Greece’s actions could become a blueprint for future crypto enforcement, especially within the European Union.
Greece Just Took a Big Step in the Crypto Crime Fight
The first crypto seizure in Greece is more than just a frozen wallet. It’s a sign that even the most sophisticated hackers can be stopped, especially when governments use blockchain transparency to their advantage.
With $1.5 billion still in play, more countries are likely to join the hunt for Lazarus Group’s stolen funds. Greece’s move may be the beginning of a broader global crackdown on state-sponsored crypto crime.
Disclaimer: The above press release has been provided by a third party. We do not verify or endorse the content and will not be responsible for any inaccuracies, claims, or damages arising from the same.