In 2003, hauling about $1 billion out of Iraq's Central Bank took three tractor-trailers. In February 2025, moving $1.5 billion out of crypto exchange Bybit took one compromised laptop at a software vendor.
The FBI attributed the Bybit theft, about $1.5 billion in virtual assets, to North Korea, per NBC News. The bureau calls the operation TraderTraitor, and its public service announcement says the thieves moved fast, converting part of the haul and scattering it across thousands of addresses on multiple blockchains. Nobody drilled a vault, and nobody had to remember where they parked the van.
Your firm may never hold a bitcoin. The Bybit heist still matters, because the method had little to do with crypto. The attackers went through a trusted vendor and fooled the people approving the transfer. That playbook works as well on a wire desk as it does on a crypto exchange.
Is Bybit the Biggest Heist in History?
By the raw dollar figure, yes. Bybit tops Iraq's roughly $1 billion, and Bloomberg Law reports it is the largest theft in the history of cryptocurrency, ahead of the $620 million Ronin Network theft that the FBI also tied to North Korea. Blockchain analytics firm Chainalysis counted $2.02 billion in crypto stolen by North Korea in 2025, out of $3.4 billion stolen worldwide, so this one job supplied about three quarters of the regime's record year.
Adjust for inflation and the record picks up an asterisk. Run Iraq's March 2003 billion through the BLS CPI Inflation Calculator to February 2025 and it comes out to roughly $1.7 billion, which edges past Bybit. So Bybit holds the title in nominal dollars. Both front-runners were state jobs, and only one of them needed trucks.
Six Decades of Heists, Side by Side
We lined up ten well-known heists, five physical and five digital, using the amounts reported at the time.
1963, Great Train Robbery (physical). A gang stopped a Royal Mail train in England and left with £2.6 million.
1978, Lufthansa heist (physical). Armed men emptied a cargo vault at New York's JFK airport of about $5.8 million in cash and jewels, then the largest cash theft in U.S. history.
1990, Isabella Stewart Gardner Museum (physical). Two men dressed as police officers took 13 works valued at an estimated $500 million.
1994, Citibank (digital). A Russian ring wired more than $10 million out of Citibank's electronic money transfer system. The bank recovered all but $400,000.
2003, Central Bank of Iraq (physical). About $1 billion in cash, loaded onto three tractor-trailers on Saddam Hussein's orders.
2014, Mt. Gox (digital). The Tokyo bitcoin exchange said it may have lost about 850,000 bitcoins, worth around $454 million, to hacking.
2016, Bangladesh Bank (digital). Attackers moved $81 million out of the central bank's account at the New York Fed. The Justice Department later charged a North Korean programmer.
2022, Ronin Network (digital). The FBI tied the $620 million theft from the blockchain behind the game Axie Infinity to North Korea's Lazarus Group.
2025, Bybit (digital). About $1.5 billion in virtual assets, attributed to North Korea.
2025, The Louvre (physical). Thieves rode a basket lift up the museum's facade and took crown jewels worth an estimated €88 million in under eight minutes. They dropped Empress Eugénie's crown on the way out.
The physical crews had to carry what they stole, so the haul topped out at whatever fit in a van or, in Baghdad's case, three tractor-trailers. The digital crews move money as data, and the totals climb accordingly. North Korea shows up three times on the digital side of that list.
Every Heist Runs on Borrowed Trust
The constant across six decades is borrowed trust. The Great Train Robbers worked from inside information about the mail train, supplied by a man they knew as the Ulsterman. The Lufthansa crew had Louis Werner, a cargo agent who supplied maps, staffing details, and timing. The Gardner thieves got through the door dressed as police officers.
The digital crews skipped the costumes and borrowed credentials. Vladimir Levin's ring used Citibank customer passwords and codes to move money to accounts in five countries. The Bangladesh Bank attackers stole the bank's credentials for payment transfers, so their requests to the New York Fed carried the bank's own authority. The scheme stalled when the hackers spelled foundation as fandation in a $20 million transfer to a Sri Lankan nonprofit, and Deutsche Bank, acting as a routing bank, asked questions. Officials said $850 million to $870 million in transfers were stopped in total. Proofreading remains the cheapest fraud control in banking.
How the Bybit Heist Worked
Bybit kept ether in a multisignature wallet built on software from a vendor called Safe, so several Bybit signers had to approve any transfer. That is a sensible control, and the attackers went around it.
On February 4, 2025, attackers compromised a Safe developer's laptop and stole an Amazon Web Services session token to get around multifactor authentication. From there, they planted malicious JavaScript in Safe's cloud storage. On February 21, Bybit's signers sat down to move ether from a cold wallet to a warm wallet, a routine job. According to an interim forensic report covered by The Block, their browsers loaded the tampered code, which altered the transaction, and investigators found no compromise of Bybit's own infrastructure. Bybit said the attackers were able to deceive its signers into approving a malicious transaction.
Every signer did their job and approved the wrong transaction, because they all trusted what the screen showed them. Multi-person approval stops a rogue employee. It cannot stop a lie that every approver sees at once.
What Financial Firms Should Take From a Crypto Heist
An RIA, family office, or title company probably doesn't run a cold wallet. It does run the workflow Bybit ran, with trusted vendors, a few people holding approval rights, and a screen everyone believes. Three changes cut the risk.
Treat vendors as part of your security program, because regulators now do. The SEC's amended Regulation S-P requires covered firms to oversee service providers that handle customer information, and RIAs with less than $1.5 billion in assets under management had to comply by June 3, 2026. That includes easy-to-miss vendors, such as the AI notetaker sitting in client meetings, which we cover in our guide to RIA AI governance policies. For a starting checklist, use these five questions for your IT provider.
Assume MFA can be bypassed. Bybit's attackers stole a live session token and went around the MFA prompt entirely. Phishing-resistant MFA, short session lifetimes, and managed devices for anyone with privileged access narrow that opening. We lay out a right-sized version of those controls in Family Office IT: Security Without Over-Engineering.
Verify payment changes away from the screen. Business email compromise, the wire fraud cousin of the Bybit attack, cost victims about $3 billion in 2025, according to the FBI's annual Internet Crime Report. The fix is unglamorous. Confirm every new or changed payment instruction by calling a number you already have on file, never one listed in the request, and train clients to expect that call. Todd Mitchell, our COO, makes the case for client training in Your Clients Are Your Weakest Link, Not Your Software.
Your Vault Has a Login Screen
Techvera's cybersecurity services and financial services practice help RIAs, family offices, and other financial firms put these controls in place and keep the evidence ready for an examiner. We hold a SOC 2 Type II attestation ourselves, so we know vendor diligence from both sides of the table. If you want to know how your approval process would hold up against a TraderTraitor-style attack, request a consultation.
Frequently Asked Questions
What is the biggest heist in history?
Measured in nominal dollars, it is the theft of about $1.5 billion in virtual assets from crypto exchange Bybit in February 2025, which the FBI attributed to North Korea. The 2003 removal of about $1 billion from Iraq's Central Bank, which Guinness World Records lists as the greatest robbery of a bank by a statesman, comes to roughly $1.7 billion in February 2025 dollars after adjusting for inflation.
How did North Korea steal $1.5 billion from Bybit?
Attackers compromised a developer's machine at Safe, the vendor whose multisignature wallet software Bybit used, and stole a cloud session token to bypass multifactor authentication. They planted malicious code in Safe's infrastructure that altered a routine Bybit transfer, so Bybit's signers approved a transaction that sent the funds to the attackers. The FBI calls the North Korean activity TraderTraitor.
How can financial firms protect themselves from attacks like the Bybit hack?
Treat vendors with access to client data as part of the security program, which the SEC's amended Regulation S-P now requires of covered firms. Use phishing-resistant multifactor authentication and short session lifetimes for privileged users. Confirm every new or changed payment instruction through a separate channel, such as a call to a phone number already on file.
About the Author
Team Techvera
Techvera Team
Articles written collaboratively by the Techvera team, combining expertise across cybersecurity, managed services, and digital transformation.