The Hellenic Anti-Money Laundering Authority in Greece conducted the country's inaugural cryptocurrency asset freezing operation, recovering funds directly linked to the $1.5 billion Bybit exchange hack attributed to North Korea's Lazarus Group. Using Chainalysis Reactor blockchain analysis tools acquired in 2023, investigators traced stolen Ethereum through complex laundering schemes involving mixers (Wasabi, Tornado Cash), decentralized exchanges, and cross-chain bridges.
Authorities identified a suspicious transaction months after the February 2025 heist, definitively linking assets in a Greek exchange service provider's wallet to primary wallets used in the breach. The operation enabled the freezing of funds before disappearance, contributing to the 5.18% ($72 million) of stolen ETH now frozen globally. Greece's Minister of Economy confirmed approximately €10 million ($11.7 million) has been returned to victims through broader anti-money laundering efforts.
In parallel, German authorities seized €34 million ($38 million) from the eXch platform on May 8—Germany's third-largest crypto confiscation—after determining it laundered €1.75 billion ($1.9 billion) in criminal funds, including Bybit hack proceeds. Despite eXch's claimed April shutdown, TRM Labs revealed continued backend API operations facilitating laundering for Lazarus Group. Bybit's LazarusBounty dashboard shows 32.78% of stolen funds remain traceable, while 62.04% has gone dark.
The news coincides with fresh exploits, including a $42 million GMX breach on July 9, underscoring persistent security challenges despite international recovery coalitions offering bounties like Bybit's 10% reward program (up to $140 million).
