$1.5 billion. One theft. One developer’s compromised workstation.
The February 2025 Bybit heist, attributed to Lazarus Group by the FBI and multiple blockchain analytics firms, redefined what “sophisticated” means in the context of cryptocurrency theft. The entry point wasn’t Bybit directly. It was a developer at Safe{Wallet}, the custody infrastructure Bybit relied on. Lazarus moved laterally from that single compromise to drain Bybit’s cold wallets in a window measured in hours. The group has now extended its UK targeting footprint to FCA-regulated exchanges and the law firms that service them.
How the TraderTraitor Campaign Works
Lazarus stole an estimated $1.7 billion in cryptocurrency in 2024, according to Chainalysis. The FBI’s TraderTraitor campaign designation covers a consistent methodology that hasn’t changed significantly because it keeps working.
It starts on LinkedIn. An employee at a cryptocurrency exchange receives an unsolicited message from what appears to be a recruiter at a credible crypto-adjacent firm. The conversation is professionally constructed, with correct terminology, believable company context, and a role that might plausibly interest the recipient. Somewhere in the process, a “technical assessment” gets shared. Or a GitHub link to a portfolio project. Or a collaboration document. The malware is in there.
Developer and engineer targets are prioritised because of their system access. Private keys, multi-sig configuration systems, and wallet management infrastructure are the objectives. A developer who touches key management is worth more targeting effort than a marketing hire.
Trojanised npm packages and Docker images are the preferred delivery mechanism for technical targets. The code in the repository can appear legitimate. Integrity verification before execution is not standard practice at many organisations. It should be.
Once inside exchange infrastructure, Lazarus moves quickly and systematically. They enumerate key management systems, map multi-sig wallet configurations, and identify the access required to authorise a drain. The Bybit architecture gave them that access through one compromised third-party developer. That’s the supply chain risk in the cryptocurrency sector: custody infrastructure dependencies that extend the attack surface well beyond the exchange’s own perimeter.
Why Law Firms Are in Scope
The targeting of law firms serving cryptocurrency clients is less about immediate theft and more about building an intelligence picture before approaching the exchange itself.
FCA authorisation support files contain exchange ownership structures, beneficial shareholder information, and operational architecture: the kind of background Lazarus uses to understand who to target and how to approach them. Litigation and enforcement files relating to crypto disputes contain counterparty information and exposure details. Custody and compliance advisory files may contain information about key management arrangements and asset protection structures.
None of this is worth an immediate ransom demand. All of it is useful for planning the actual theft.
UK law firms advising FCA-regulated exchanges have received less direct threat intelligence focus than the exchanges themselves. That’s a gap the group appears to be exploiting.
What the FCA Regime Creates
The Financial Services and Markets Act 2023 expanded FCA oversight of digital asset activities, which means more UK exchanges are now operating under formal regulatory supervision. That’s a larger, more concentrated, more formally documented pool of targets, with publicly known names, registered ownership, and regulatory filings that create a starting point for targeting research.
FCA authorisation is not a security accreditation. It establishes a regulatory relationship, not a security baseline. Exchanges that interpret regulatory compliance as a security posture are materially exposed.
Actions Worth Taking Now
Brief technical and compliance staff on the TraderTraitor recruitment lure specifically, not as a generic phishing example, but as a named, current campaign. The social engineering is credible enough that general awareness training doesn’t catch it. People need to know that unsolicited LinkedIn outreach with a technical component, from anyone in the crypto-adjacent space, is a known Lazarus vector right now.
Key management systems need to be air-gapped from general corporate infrastructure. Multi-sig coordination environments should have the most restrictive access controls in the organisation. If they’re reachable from a developer’s standard workstation, the Bybit architecture is relevant to your risk picture.
Code provenance controls for npm packages, Docker images, and external repository contributions are not optional at this threat level. Require integrity verification before execution. This is operationally inconvenient. It is less inconvenient than losing $1.5 billion.
Law firms with cryptocurrency clients: treat those matter files as high-risk. Enhanced access controls, access logging, and monitoring for unusual file access patterns on crypto-related matters, particularly anything touching FCA regulatory dimensions or custody structures.