Crypto from Bybit $1.5 billion heist frozen by Greek authorities

Financial authorities in Greece have restricted access to a crypto wallet with funds originating from the Bybit exchange hack, which resulted in the loss of around $1.5 billion of ether in February.

The intervention, described as a first in the country, is part of ongoing investigations into what has been regarded as the biggest heist in crypto history, linked to the notorious Lazarus Group hacking syndicate.

Greek officials block illicit crypto assets on a local exchange

The Hellenic Anti-Money Laundering Authority (HAMLA) has joined the complex investigation into this year’s massive theft from one of the largest digital currency exchanges. The government body recently froze assets traced back to the heist.

HAMLA President Charalambos Vourliotis made the announcement at a briefing, during which he informed Greece’s Minister of Economy and Finance, Kyriakos Pierrakakis, about his agency’s work in the crypto space.

Acting on received intelligence in May, the authority identified a user registered on a Greek trading platform who received a “significant amount” of ether (ETH) in their account.

Using specialized software to analyze the suspicious transaction, HAMLA analysts were able to establish that the coins were part of those stolen from Bybit earlier this year.

The wallet was immediately frozen, carrying out a prosecutor’s order, the Greek newspapers Proto Thema and Kathimerini reported on their websites on Tuesday.

The anti-money laundering agency also issued a seizure order for the crypto holdings and submitted a report to the Prosecutor’s Office of Greece for further legal action.

The authorities are yet to provide details about the seized holdings and the recipient of the digital transfer. But the local press already described the move as a first, both in terms of Greece freezing illicit crypto funds and finding Greek fingerprints in a digital financial crime of this caliber, noting:

“The case has drawn international attention, with the U.S. Federal Bureau of Investigation (FBI) issuing a public alert confirming the freezing of suspicious digital assets.”

Cryptocurrency seized in Greece linked to the Bybit breach

The Dubai-based Bybit, a leading crypto exchange in terms of daily trading volume, announced it had been hacked on February 21, 2025, reporting the theft of $1.5 billion in ETH, deemed the largest cryptocurrency theft to date.

Blockchain analysis has since linked the attack to the Lazarus Group, uniting hackers allegedly controlled by the regime ruling North Korea, which reportedly exploited security weaknesses and transferred the digital coins to multiple addresses.

HAMLA began to unravel the Greek connection last month when it was notified of a suspicious movement of funds, more specifically, the crediting of a “large sum of Ethereum” to a wallet hosted by an unnamed provider of crypto exchange services in Greece.

Using blockchain forensics tools at their disposal, the agency’s analysts conducted a series of checks to “untangle the thread,” the weekly Proto Thema detailed in a follow-up article on Wednesday.

The trained specialists found that the funds had not come from a regular commercial transaction such as a cryptocurrency purchase but followed a specific transaction trail already flagged by the FBI.

It took them to one of the ETH wallets involved in the laundering of the Bybit funds, which had been split and moved through multiple wallets before some of it ended up in Greece.

Investigators haven’t been able to prove yet that the Greek owner of the frozen wallet actually knew the true origin of the funds received, the report noted.

However, law enforcement officials in Greece are still considering all scenarios, including the possibility that the person acted as an intermediary link in a global digital money laundering scheme.

Cryptopolitan Academy: Coming Soon - A New Way to Earn Passive Income with DeFi in 2025. Learn More