Eric Wall Predicts Lazarus Group’s Cash-Out Strategy as Bybit Prepares for $1.5B ETH Buyback

Bybit, a major cryptocurrency exchange, is moving to shore up approximately $1.5 billion worth of Ether (ETH) through loans after funds were stolen by North Korea-linked Lazarus Group, according to industry analyst Eric Wall. 

Per Wall’s analysis in a February 21 X post, the exchange’s decision to take out loans instead of liquidating its assets suggests an attempt to recover lost funds before making any market moves.

The Lazarus Group usual laundering process, as detailed in a 2022 Chainalysis report, follows a structured approach:

Stolen ERC-20 tokens, such as staked Ether (stETH), are swapped into ETH.ETH is converted into Bitcoin (BTC).BTC is cashed out for Chinese renminbi through Asian exchanges.The proceeds are used to fund North Korea’s nuclear and ballistic missile programs.

Lazarus Group, a cybercriminal organization linked to the North Korean government, has a history of orchestrating large-scale cryptocurrency thefts. In 2022, reports revealed that North Korea was still holding $55 million in funds stolen as far back as 2016, indicating a long-term strategy of gradual cashing out.

Bybit’s Loan Approach

Bybit opted for a loan instead of immediately liquidating $1.5 billion in ETH to avoid disrupting the market. If the stolen funds had been recoverable, repaying the loan with confiscated ETH would have been preferable to selling large amounts on the open market according to Eric Wall. 

However, given Lazarus Group’s involvement, the chances of fund recovery are slim.

Bybit will likely need to purchase ETH to settle the loan or repay the USD equivalent, which could result in over-the-counter (OTC) buys. 

Meanwhile, Lazarus Group is expected to continue liquidating ETH into BTC, creating a balancing effect on the Ethereum market. Over time, Bitcoin could see increased sell pressure as the funds are eventually cashed out.

Impact on the Crypto Market

Per Wall’s analysis, the immediate impact on Ethereum’s price is expected to be neutral, as Bybit’s purchases may offset the sell pressure from Lazarus Group. However, Bitcoin could experience gradual downward pressure as BTC holdings from these transactions enter the market over an extended period.

North Korea’s Use of Stolen Assets

Funds stolen by Lazarus Group are believed to be funneled into North Korea’s weapons development programs, including nuclear and ballistic missile research. 

Analysts, including cybersecurity experts at Chainalysis, have noted that the regime employs a systematic process of laundering stolen digital assets, converting them from Ethereum to Bitcoin before cashing out via Asian exchanges. 

The proceeds are then reportedly used to bypass international sanctions, acquiring critical technology and materials for its missile programs. The U.S. government and allied nations have long accused North Korea of financing its military ambitions through cyber heists, with recent reports estimating that these operations contribute significantly to its defense budget. 

The confirmation of Lazarus Group’s involvement in the Bybit hack further underscores the intersection of cryptocurrency theft and global security threats.