World of Secrets – Bonus: The Lazarus Heist Special

BBC Podcast | September 2, 2025

Overview

This gripping bonus episode of World of Secrets brings listeners a special story from The Lazarus Heist series, delving into the largest crypto theft in history. In early 2025, over $1.5 billion vanished from the Singapore-based exchange Bybit in minutes. Through expert interviews, on-the-ground reporting, and deep technical breakdowns, the episode exposes not only the stunning audacity of the North Korean Lazarus Group’s cyber attack, but also the regime’s evolving power on the battlefield and world stage.

The narrative merges cybercrime intrigue with geopolitical urgency, revealing how North Korea’s hacking and military adventures intertwine, fueling Kim Jong Un’s ambitions and challenging global security.

Key Discussion Points & Insights

1. The $1.5 Billion Bybit Heist: Anatomy of an Unprecedented Cybercrime

Timestamps: [01:29]–[07:35]

• The Setup: On a Friday night in February 2025, Bybit’s CEO and team prepare to transfer 30,000 Ethereum (~$100M) from a secure offline vault to a live wallet.
• The Shock: Within minutes, they realize 401,000 Ethereum (almost $1.5B) is missing—the entire vault emptied (Geoff White: “That’s nearly $10 million a second. Almost certainly the fastest heist of all time.” [06:09]).
• Global Impact: Bybit is a major platform with 70 million users and $36B traded daily; a hack of this scale rocks the industry.
• Immediate Response: CEO Ben Zhou addresses users in a late-night livestream, confirming the breach and emphasizing the scale ([03:33]).

2. Real-Time Fallout: Blockchain Sleuths and Investigators

Timestamps: [04:55]–[07:25]; [14:05]–[21:37]

• Investigators’ Shock: Security expert Warren Mercer tracks the movement live on the blockchain and is “dumbfounded” by the sheer amount ([05:58]).
• Visibility and Velocity: The public ledger makes every move visible, but the speed and fragmentation (“90 transactions an hour… like a high speed car chase” [19:50]) creates tracing chaos.
• FBI’s Hunt: Chris Wong and his team at the FBI track the laundering in real time, racing against relentless, 24/7 activity ([19:18]).

3. North Korea’s Evolving Cyber and Military Ambitions

Timestamps: [20:40]–[26:10]; [29:02]–[37:58]

• Lazarus Group’s Signature: The cybercriminals’ fingerprints—51 Ethereum addresses—lead directly to the North Korean regime ([21:06]).
• Crypto Laundering Economy: Nick Carlson explains how “cryptocurrencies have revolutionized the money laundering world,” creating broker-facilitated swaps between criminal groups and state actors ([28:22]).
• Motivations: The theft isn’t just for profit; it helps sustain North Korea's regime and weapons ambitions, sidestepping sanctions and fueling strategic goals ([26:10], [33:02]).

4. Human Stories: From Prisoner of War to Diplomacy

Timestamps: [10:05]–[16:20]; [41:22]–[48:27]

• Rare Prison Interview: Journalist Chul Wan Jung meets Rhee, a young North Korean POW held in Ukraine, uncovering his grim journey from Pyongyang to the Russian front ([12:17], [15:23]).
• Battlefield Experience: Rhee describes the horror and confusion of combat, isolation from Russian allies, and devastating losses among North Korean troops ([43:03]–[44:39]).
• Military Lessons Learned: North Korean forces suffer huge casualties (up to 40% [45:16]) but gain invaluable drone warfare expertise alongside Russia—a chilling prospect for future conflicts ([48:05]).

5. Technical Insights: How the Heist Was Engineered

Timestamps: [35:05]–[39:00]

• The Intrusion Path: The hack started weeks earlier with targeted malware against a SafeWallet developer, giving hackers privileged “keys to the kingdom” ([37:15]).
• The Deception: Bybit’s staff saw normal transfer screens but, behind the scenes, hackers secretly rewrote the transaction to sweep the entire vault—“the art of deception” ([39:03]).
• Result: Of the stolen funds, only 5% was ever recovered. Most vanished into untraceable digital dust ([39:46]).

6. Broader Geopolitical Stakes — “Kim Jong Un Wants Everything”

Timestamps: [29:16]–[34:25]

• Diplomacy vs. Control: Former US envoy Steve Biegan reflects on Kim Jong Un’s ambitions: absolute power, nuclear weapons, relief from sanctions ([32:19]).
• Strategic Impact: The $1.5B theft equals 5% of North Korea’s GDP, undermining years of international pressure in mere minutes ([33:47]).
• Regime Resilience: “With their help, Kim Jong Un is finding it easier to overcome efforts to control him... No longer isolated, his is a regime unleashed.” (Jean Lee, [56:15], [56:19])

7. The Pressure Within: Life and Death Stakes for Operators

Timestamps: [54:24]–[55:21]; [50:40]–[53:50]

• Fear at the Top: Both hackers and diplomats in North Korea risk deadly consequences for failure; botched missions are often met with execution or enforced disappearance ([53:06], [54:24]).
• A Telltale Sign: Hackers performed a low-value ($90) test before the full transfer, a sign of caution and terror at the stakes ([54:24]).

Notable Quotes & Memorable Moments

• “It’s as if the thieves have backed up a fleet of trucks and emptied a bank vault.”
  – Jean Lee, [04:43]

• “When you see a number like $1.5 billion… it’s a GDP of some nation states.”
  – Warren Mercer, [05:58]

• “If you’re tracing any assets that are moving like this, any break that you take, you’re behind.”
  — Chris Wong, [20:19]

• “Imagine this crypto as a giant bag of red marbles… Then they smash all the marbles into pulverized dust and blow it all over the Internet.”
  — Geoff White, [23:47]

• “I did not get into crypto because I like crypto. I got into crypto because North Korea was stealing crypto.”
  — Nick Carlson, [25:19]

• “Chairman Kim Jong Un… wants it all. He wants to keep the weapons, get rid of the sanctions. But… if he really knew what he wanted, he’d have to make some choices.”
  — Steve Biegan, [32:19]

• “This one recent theft of $1.5 billion, that’s 5% of their GDP.”
  — Steve Biegan, [33:47]

• “The hackers can just change that... Like a magic trick behind the scenes.”
  — Warren Mercer & Geoff White, [39:00]

• “In one fell swoop. A $1.5 billion cyber heist wipes out a year's worth of effort to put pressure on the North Korean economy.”
  — Steve Biegan, [34:08]

• “The Lazarus Group is now a major player in North Korea's economy.”
  — Jean Lee, [34:25]

• “You see no benefit of this. They don't reap any benefit at all. The regime reaps the benefit."
  — Warren Mercer on the hackers, [55:06]

Important Timestamps

• [01:29] — The Bybit heist begins in Singapore
• [03:33] — CEO Ben Zhou’s somber livestream
• [05:58] — Warren Mercer on the staggering scale: “a GDP of some nation states”
• [12:17]–[15:16] — POW interview: Rhee’s story
• [19:50] — Chris Wong on the “high speed car chase” of the laundering
• [21:06] — Evidence points directly to the Lazarus Group/North Korea
• [26:10] — The role of brokers and the transformation of money laundering
• [29:16] — Steve Biegan describes Kim Jong Un’s mindset
• [33:47]–[34:08] — The geoeconomic impact: 5% of North Korea’s GDP stolen in minutes
• [37:15]–[39:03] — How the hack worked: social engineering, malware, and digital trickery
• [45:16] — 40% estimated casualty rate among North Korean troops in Russia
• [49:04]–[50:11] — The nuclear knowledge risk from North Korea–Russia ties
• [54:24] — The $90 test transaction: hacker caution under immense pressure

Flow and Tone

The episode is compelling, suspenseful, and journalistic, weaving intimate human stories with high-stakes cyber drama. The tone is urgent but explanatory, mixing technical clarity with geopolitical and personal nuance. First-hand accounts, expert testimony, and immersive analogies help bring the invisible world of cyberwarfare into sharp focus.

Conclusion

This special episode leaves listeners both informed and unsettled. The Lazarus Group’s hack is not just a record-breaking crime—it’s a seismic event with implications for global security, the future of warfare, and the very survival of the North Korean regime. Kim Jong Un’s ability to evade sanctions and purchase knowledge, especially with potential Russian help, threatens to upend the balance of power in Asia and beyond.

If you want a riveting, eye-opening journey through the intersection of digital heists and statecraft—this is essential listening.

For the full experience and further episodes, search "The Lazarus Heist" on your BBC podcast platform.