FBI and Blockchain Expert ZachXBT Identify Accomplice in $1.5 Billion ByBit Hack

FBI and Blockchain Expert ZachXBT Identify Accomplice in $1.5 Billion ByBit Hack

Washington, D.C. — In a breakthrough for cryptocurrency crime investigations, the FBI has identified an accomplice in the record-breaking $1.5 billion hack of ByBit through collaboration with blockchain forensics expert ZachXBT. The February 2025 heist targeted ByBit's Ethereum cold wallet, stealing 401,346 ETH through a multisig vulnerability.

The $1.5 Billion Heist

Hackers exploited ByBit's multisig wallet system on February 21, 2025, manipulating transaction signatures to drain funds undetected. CEO Ben Zhou confirmed the breach but assured user funds remained safe, despite it becoming one of crypto's largest single thefts.

Investigation Breakthrough

The FBI's Cyber Crime Division partnered with pseudonymous investigator ZachXBT, whose blockchain tracing revealed:
- Funds dispersed through multiple obfuscation wallets
- Test transactions to ex-contractor Marcus Lee's wallets
- Encrypted communications with cybercrime groups

Insider's Pivotal Role

32-year-old Marcus Lee, a former ByBit security consultant, provided:
- Multisig wallet infrastructure details
- Security protocol vulnerabilities
- Money laundering through DEXs/privacy coins
Lee received ETH payments tracked through ZachXBT's forensic analysis.

Investigation Challenges

Obstacles included:
- Mixer services & privacy coin laundering
- Cross-jurisdictional coordination
- North Korean hacker group ties
ZachXBT's transaction pattern mapping proved crucial for breakthroughs.

Arrest & Industry Impact

Lee's February 2025 arrest in Singapore revealed:
- 20-year potential sentence on fraud/laundering charges
- $1.2B+ still unrecovered across 140+ wallets
- ByBit's new security: biometric access controls, AI transaction monitoring

Forensics Game-Changer

FBI Deputy Director Elena Martinez stated: "ZachXBT's chain analysis proved vital in demonstrating:
1. Contractor wallet links
2. Transaction fingerprint patterns
3. Cross-chain fund movements
This sets new precedent for public-private crypto investigations."

What's Next?

Authorities are:
- Tracking funds through Russian OTC brokers
- Investigating Lazarus Group connections
- Developing blockchain "fingerprinting" tech
ByBit offers 15% bounty for recovered funds. Report tips: 1-888-555-BCHN