Bybit Sits at Center of $2B Illicit Cash Flow Through Crypto Exchange

Bybit, a Dubai-based crypto exchange, has been linked to $2 billion in illicit financial flows connected to Iran. The money trail leads back to the largest single crypto exchange hack in history, where North Korean state-sponsored hackers stole $1.5 billion worth of ether from Bybit on February 21, 2025.

The attackers converted a significant portion of the stolen funds into Tether (USDT) to make them easier to move and harder to freeze. This allowed Iranian entities to access the funds, despite US sanctions that have cut the country off from the conventional financial system for decades.

Bybit explicitly prohibits service to Iran, but it appears that the exchange became a transit point for funds that ultimately benefited Iranian entities. The hack sits at the center of this arrangement because the scale of the theft generated a surplus of digital assets that needed to be laundered and deployed.