Bybit Blocks Meme Token Linked to Lazarus Group

The exchange Bybit has successfully blocked the meme token QinShihuang, which is allegedly connected to the hacker group Lazarus.

Thanks to @caLilyLiu and the @pumpdotfun team for taking swift action to block and remove a Solana-based token whose creator may be affiliated with hacker groups, ensuring the security of the ecosystem. This is a great example of proactive security in action

— Bybit (@Bybit_Official) February 23, 2025

The team thanked Solana Foundation President Lily Liu and representatives from the Pump.fun platform “for their prompt actions in blocking and removing the coin.”

The launch of the meme coin named QinShihuang was first reported by on-chain investigator ZachXBT. He revealed that a wallet linked to Lazarus transferred 60 SOL to another address before issuing 500,000 QinShihuang tokens. Within three hours, trading volume reached $26 million.

ZachXBT traced part of the stolen funds. On February 22, the group transferred $1.08 million in USDC from Bybit to an Ethereum address, then moved the assets to the Solana network.

The perpetrators then sent USDC to Binance Smart Chain (BSC), where they split the assets across more than 30 wallets. After splitting, the funds were recombined, transferred to a new address, and then redistributed to 10 wallets with 106,000 USDC each in the Solana network. This concluded the asset obfuscation cycle.

ZachXBT noted that the wallets used in the scheme had previously received microtransactions with “dust” meme tokens. However, instead of ignoring them, the hackers exchanged these tokens for SOL, mixed them with other funds, and used them for trading on Pump.Fun. These actions obscured the origin of the funds.

The analyst published addresses associated with the laundering, listing nearly 920 wallets. Some of these were removed from tracking interfaces to make it harder for hackers to conceal financial flows.

Back on February 21, Bybit faced the largest hack in the crypto industry, amounting to $1.5 billion. Experts from Arkham Intelligence linked the incident to the North Korean Lazarus Group.

Later, Bybit CEO Ben Zhou announced that the exchange had fully restored its Ethereum reserves after the hack (~444,870 ETH) through loans, whale deposits, and direct purchases.