Elliptic attributes the February 2025 theft of about $1.46 billion from Bybit to North Korea's Lazarus Group, citing laundering behavior and links to the group's crypto theft history. The attackers quickly swapped freezeable tokens such as stETH and cmETH into Ether, then split the funds into 50 wallets holding roughly 10,000 ETH each. Elliptic says the wallets were being emptied through DEXs, cross-chain bridges, centralized exchanges, eXch, and conversions into bitcoin, with mixers expected as a possible later stage. The report frames the case as both a record scale theft and a live tracing effort, with Elliptic, Bybit, exchanges, and investigators working to flag, seize, or block proceeds before cash-out.