AI
The Supply Chain Attack That Emptied Bybit
In February 2025, DPRK attackers stole 400,000 ETH worth $1.4 billion from Bybit. They compromised Safe Wallet, Bybit’s third-party cold wallet signing provider. One developer downloaded an infected Docker project on February 2. Over the next two weeks, attackers mapped Safe Wallet’s AWS infrastructure and injected malicious JavaScript on February 20. On February 21, when Bybit signed a routine transaction, a delegate call loaded the attacker’s contract and executed sweep ETH and sweep ERC20, draining the wallet instantly.
Immediate Conversion and Money Dispersing: The First Two Laundering Moves
After the theft, DPRK used immediate asset conversion, spreading stolen ETH across stETH, USDT, and other tokens through multiple wallets in parallel. Then came money dispersing: the initial 1.4 billion went to 50 wallets at 10,000 ETH each, then split again into hundreds more. Analysts can detect this through timing correlation (script-driven transactions cluster in time), gas usage similarity, and wallet clustering. The volume is the tell. 1.4 billion moving at once creates patterns no legitimate actor produces.
Crosschain Bridges and KYC-Free Platforms
Bitcoin is DPRK’s preferred end-state currency. To convert stolen ETH to BTC, they used crosschain bridges including Chainflip and Multichain, plus wrapped tokens. Tracking this means monitoring bridge inflows and outflows, comparing amounts across Ethereum and Bitcoin wallets to confirm the same funds arrived. They also routed funds through a KYC-free exchange platform that requires no identity verification. The volume was so large it temporarily overwhelmed the platform. Analysts can flag all deposit wallets from that platform and trace the ETH-to-BTC swap flow.
Mixers, Coin Join, and the OTC Cash Exit
Coin join merges your transaction with another user’s, obscuring which funds came from where. A mixer goes further: funds enter a pool, cycle through multiple wallets, and exit clean to a different address. Both techniques break the direct chain analysts need to follow money. For the final step, DPRK cashed out through OTC brokers in Southeast Asia, Eastern Europe, and Latin America, using small businesses to convert crypto to dollars. Once money leaves the blockchain, tracking stops. Analysts can identify known OTC broker wallets in those regions and work backward.
An AI Agent Built to Follow the Money
Roccia built an LLM-powered AI agent with three MCP servers: MCPerscan queries Etherscan for Ethereum transactions, a blockchain intelligence server labels known wallets, and a custom server detects money laundering patterns including gas fee uniformity and wallet clustering. The agent maintains persistent context across investigation steps and writes results to a Neo4j graph that grows dynamically as it follows wallets. It generates HTML reports with transaction tables, pattern flags, timing analysis, and basic recommendations, giving analysts a structured starting point.
Demo Results and the Limits of This Proof of Concept
The live demo traced the Bybit attacker’s initial wallet, found the top 10 transactions at 10,000 ETH each, confirmed all flagged as known DPRK addresses through blockchain intelligence, and stored the graph in Neo4j. The agent detected volume spikes, mixer usage, and exchange hopping. Limits are real: loading the full graph for a $1.5 billion hack crashed Roccia’s machine. The agent covers only Ethereum, misses dormant wallets that transact later, and hits API rate limits. For production use, Neo4j needs replacing with something that handles larger data.
Notable Quotes
Last February, they stole $1.4 billion Thomas “fr0gger_” Roccia · ▶ 1:12
boom just like that 1.5 uh billion of US Thomas “fr0gger_” Roccia · ▶ 9:01
the platform was temporarily overwhelmed Thomas “fr0gger_” Roccia · ▶ 14:47
autonomous LLM system that will reason Thomas “fr0gger_” Roccia · ▶ 18:02
Key Takeaways
- DPRK stole $1.4 billion from Bybit by compromising Safe Wallet’s JavaScript signing interface.
- Six laundering techniques including crosschain bridges, KYC-free platforms, mixers, and OTC cash-out.
- An AI agent with three MCP servers can automate blockchain money trail analysis.
- Scale limits current tools: a $1.5 billion transaction graph crashed Roccia’s local machine.
About the Speaker(s)
Thomas “fr0gger_” Roccia is a Senior Security Researcher at Microsoft with over 15 years of experience in the cybersecurity industry. His work focuses on threat intelligence and malware analysis. Throughout his career, he has investigated major cyberattacks, managed critical outbreaks, and collaborated with law enforcement while tracking cybercrime and nation-state campaigns. He has traveled globally to respond to threats and share his expertise. Thomas is a regular speaker at leading security conferences and an active contributor to the open-source community. Since 2015, he has maintained the Unprotect Project, an open database of malware evasion techniques. In 2023, he published Visual Threat Intelligence: An Illustrated Guide for Threat Researchers, which became a bestseller and won the Bronze Foreword INDIES Award in the Science & Technology category.