SBI Crypto Reportedly Hit by $21M Hack With Suspected DPRK Links

Logo

Finance

Share this article

SBI Crypto, a subsidiary of Japan’s SBI Group, has reportedly suffered a $21 million exploit with blockchain sleuths pointing to possible ties with North Korean hackers.

By Oliver Knight|Edited by Nikhilesh De

Oct 1, 2025, 2:44 p.m.

Lazarus Group, a cybercrime organization run by the North Korean government, may have links to this week's exploit of Euler Finance. (Micha Brandli/Unsplash)
  • Addresses linked to SBI Crypto saw suspicious outflows across BTC, ETH, LTC, DOGE and BCH on Sept. 24, later funneled through instant exchanges and Tornado Cash.
  • ZachXBT highlighted similarities between the incident and prior North Korea-linked crypto heists.
  • SBI Group has not publicly confirmed the hack and did not respond to CoinDesk’s request for comment.

Addresses linked to SBI Crypto, a subsidiary of Japan’s financial giant SBI Group, saw suspicious outflows worth roughly $21 million on Sept. 24, 2025, according to blockchain investigator ZachXBT.

The stolen funds included bitcoin BTC$117,526.08, ether ETH$4,341.94, LTC$111.52, DOGE$0.2444 and BCH$583.81. The loot was then funneled to five instant exchanges before being deposited into Tornado Cash, a crypto mixing service that previously been sanctioned by the U.S. Treasury.

STORY CONTINUES BELOW

Don’t miss another story.Subscribe to the Crypto Daybook Americas Newsletter today.See all newslettersBy signing up, you will receive emails about CoinDesk products and you agree to ourterms of useandprivacy policy.

In a Telegram post, ZachXBT noted that several indicators resemble tactics used in previous North Korean state-backed cyberattacks, raising concerns that this incident could be another in a string of DPRK-linked crypto heists.

SBI Crypto operates as a mining pool under SBI Group, a publicly traded financial conglomerate in Japan with significant exposure to both traditional and digital assets.

As of publication, SBI Group has not publicly disclosed the incident or issued an official response. SBI Group did also not respond to CoinDesk’s request for comment.

North Korea-linked hacking groups, particularly Lazarus Group, have been tied to billions in stolen digital assets in recent years. The funds are often laundered through decentralized mixers like Tornado Cash, despite global regulatory crackdowns.

More For You

By Krisztian Sandor, AI Boost|Edited by Stephen Alpher

2 hours ago

Solana (CoinDesk)

VisionSys AI is the latest to join the roster of Solana-focused digital asset treasury companies, which collectively hold $3 billion in tokens.

What to know:

  • Nasdaq-listed VisionSys AI (VSA) unveiled Wednesday a $2 billion treasury strategy focused on Solana, first aiming to acquire and stake $500 million in SOL within six months.
  • The company the day prior appointed early Solana backer Hakob Sirounian as chief strategy officer.
  • VisionSys joins other public firms in holding crypto on their balance sheets, following a trend of using digital assets for yield-earning strategies.

 

Leave a Reply

Your email address will not be published. Required fields are marked *