Greek authorities have successfully frozen a crypto wallet linked to the monumental $1.5 billion theft of funds from the Bybit exchange, marking a significant enforcement action regarding stolen digital assets in Greece.

According to Greek news sources Proto Thema and Kathimerini, the Hellenic Anti-Money Laundering Authority (HAMLA) took action following intelligence received in May, which indicated considerable inflows of Ether (ETH) to a user account on a local crypto trading platform.

By employing advanced blockchain forensic tools, HAMLA verified that the funds traced back to the massive Bybit breach that occurred in February 2025.

🚨 $1.5B Bybit heist trail leads to Greece 🇬🇷
Greece’s AML Authority froze an $ETH wallet on a local exchange—linked to the historic February Bybit attack by North Korea’s Lazarus Group. This marks Greece’s first-ever crypto seizure tied to global AML enforcement. pic.twitter.com/MMSW2d2kXA
— CryptoPotato Official (@Crypto_Potato) June 25, 2025

Wider Crypto Laundering Network Tied to Bybit Exchange Hack

ZachXBT highlighted how entities like North Korea’s Lazarus Group orchestrate extensive laundering operations using over-the-counter brokers, privacy wallets, and exchanges located in lightly regulated environments. He theorizes that Tron’s “Black U” market might be worth between $5–10 billion, much of which remains unaccounted for.

In the Bybit incident, the Lazarus Group managed to channel $160 million through illicit pathways within a mere two days, pointing to a disturbing increase in laundering capabilities.

Lazarus Group just connected the Bybit hack to the Phemex hack directly on-chain, mingling funds from the initial theft addresses of both incidents.
Overlap address: 0x33d057af74779925c4b2e720a820387cb89f8f65 Bybit hack txns on Feb 22, 2025:… pic.twitter.com/dh2oHUBCvW
— ZachXBT (@zachxbt) February 22, 2025

Despite mounting concerns, numerous exchanges continue to reap profits from illicit transactions without facing repercussions. The U.S. Department of Justice has revealed that North Korea also deploys IT personnel abroad using fake identities to redirect funds to their homeland, often in USDT or USDC. The Athens seizure represents a notable success in intercepting this extensive laundering operation.

Greek Wallet Tied to the Hack Frozen in Landmark Seizure

The perpetrators reportedly utilized advanced laundering techniques, dispersing the stolen ETH over numerous accounts to conceal its origins. The frozen wallet in Greece symbolizes the first time local authorities have effectively traced and blocked digital assets involved in such a well-known theft. A formal seizure order has been issued, and the case is currently under the jurisdiction of Greek prosecutors.

HAMLA President Charalambos Vourliotis briefed Finance Minister Kyriakos Pierrakakis about the agency’s findings, emphasizing the importance of this discovery. Although the recipient of the illicit ETH has not been formally identified, further legal actions are underway.

This operation reflects an advancing capacity among European regulators to monitor crypto crime in real time, with Athens becoming part of a growing global initiative guided by international agencies, such as the FBI, which has already made public mention of the Bybit case.

Forensic investigation clarified that the Greek-associated wallet was not tied to a standard commercial transaction. Instead, the ETH followed a previously marked pattern identified by U.S. investigators, confirming its link to the Bybit hack. Analysts believe the Greek account might have served as a connection point in a broader laundering chain, though it remains unclear if the wallet’s owner was aware of the illicit nature of the funds.

As digital asset crime increasingly transcends borders, Greece’s decisive action sets a groundbreaking standard in crypto enforcement.