Bybit hackers move to meme coins to launder funds and scam people

After the largest heist in crypto history, hackers of the Bybit exchange are reportedly trying to use meme coins to launder a portion of the stolen funds. Moreover, an investigation showed that the same hackers might be behind multiple meme coins.

Blockchain observers claim that the Lazarus Group, a North Korea state-supported hacking group associated with the Bybit hack, is using Pump.fun, a popular meme coin launchpad on the Solana (SOL) blockchain, to launder the stolen funds.

Multiple reports allege that Lazarus sent 50 SOL ($8000) to a wallet that launched the QinShihuang token, which soon after reached $3 million in market capitalization and almost $44 million in trading volume in 24 hours.

"By luring real liquidity from PumpFun users, they mixed stolen funds with legitimate market activity, making detection harder. Once enough liquidity was secured, they dumped the tokens, cashed out, and fragmented funds across multiple wallets," Atlas an on-chain analyst, said.

While the volume is relatively small compared to the stolen funds, which are worth more than $1 billion, commenters estimate that this might be only a test and that the market will see more similar attempts from Lazarus.

Meanwhile, Conor Grogan, Head of Product at the Coinbase crypto exchange, found that someone sent North Korea a meme coin called "Lazerus" that was swapped into thousands of dollars worth of SOL.

"Don't do this, it's an international crime," Grogan warned, reminding meme coiners that North Korea is a sanctioned country.

However, it seems that Lazarus hackers are no strangers to meme coins. ZachXBT, the independent blockchain detective who won a bounty with his investigation partner by providing proof that Lazarus is behind the Bybit hack, says that the same hackers might be behind multiple meme coin launches on Pump.fun as well.

"Fifteen hrs ago, I made 920+ addresses receiving funds tied to the Bybit hack public and noticed a person laundering for Lazarus Group previously launched meme coins via Pump Fun," ZachXBT said.

According to him, all funds tied to the hack were then transferred to various services and exchanges.

"As if this year could not get any stranger, we have an entity laundering for the Bybit hack who launched/traded Pump meme coins," the investigator concluded.