The Greek Anti-Money Laundering Agency has conducted the first crypto asset freezing, targeting funds related to the $1.5 billion hack of the crypto exchange Bybit in February 2025.
This is a turning point in the global fight against financial cybercrime and raises new questions about the security of crypto exchanges in a rapidly expanding market.
Greece Successfully Traces the $1.46 Billion Lazarus Group Hack
The attack on Bybit is believed to have been carried out by Lazarus, a North Korean hacker group known for sophisticated cyber attacks targeting crypto platforms.
The Bybit hack, called "TraderTraitor" by the FBI, shocked the industry after the attackers stole approximately $1.46 billion in Ethereum. This amount exceeds the total value stolen by North Korea-related groups throughout 2024, according to Chainalysis.
After the incident, Chainalysis analysts assisted the Greek AML Agency in tracing the funds. They also identified a wallet related to a local trading platform in Greece.
North Korea-related groups have been stealing funds for years. Source: ChainalysisAs a result, suspicious assets were successfully frozen, marking the first cross-border fund recovery from such a cyber attack. Greece's National Minister of Economy and Finance, Kyriakos Pierrakakis, emphasized the role of blockchain technology and international cooperation in combating financial crime.
This development signals a positive change for countries striving to regulate crypto assets while highlighting the industry's increasingly significant security risks.
Lazarus, previously responsible for incidents like the 2022 Axie Infinity hack ($620 million), continues to evolve. Just two days after the Bybit breach, the group demonstrated money laundering capabilities.
TRM Labs noted that this activity reflects a highly coordinated "flood the zone" strategy. This strategy involves rapid, multi-directional transactions to overwhelm monitoring and compliance systems.
"The Bybit exploit shows an enhanced 'flood the zone' technique—overwhelming compliance teams, blockchain analysts, and law enforcement with rapid, high-frequency transactions across multiple platforms, thus complicating tracking efforts," TRM observed.
This illustrates the urgent need for closer collaboration between regulatory agencies and blockchain analysis companies.
The incident also puts additional pressure on exchanges like Bybit to enhance security, especially as deposits on both DeFi and CeFi platforms surge. According to defillama, the Total Value Locked (TVL) globally reached $121 billion as of July 2025.
Greece's success could inspire similar efforts from countries like South Korea and the United States. However, tracking and seizing crypto assets remains challenging due to the inherent anonymity of blockchain networks.
