Bybit, the world’s second-largest cryptocurrency exchange by trading volume, is offering a massive bounty to crack crypto’s largest theft in history.

The exchange is pledging 10% of recovered funds—potentially up to $140 million—to cybersecurity experts and blockchain analysts who help track and retrieve stolen assets.

The bounty is tied to the recovery of over $1.4 billion in compromised Ethereum.

“Within 24 hours of the event, we were overwhelmed with support from some of the best people and organizations in the industry, and we do not take it for granted. We have shared in a dark moment of crypto history, and we’ve proven we are better than the malicious actors,” said Bybit co-founder and CEO Ben Zhou.

He emphasized Bybit’s commitment to strengthening security and liquidity while fostering industry-wide collaboration.

So far, on-chain investigator ZachXBT identified North Korea’s Lazarus Group as the masterminds behind the hack, where funds were taken and moved in four different moves:

• 401,347 $ETH worth $1.12 billion
• 90,376 $stETH worth $253.16 million
• 15,000 $cmETH worth $44.13 million
• 8,000 $mETH worth $23 million

ZachXBT secured a 50,000 ARKM bounty for discovering that Bybit’s Ethereum (ETH) multisig cold wallet was exploited during a routine transfer to the exchange’s warm wallet.

The hackers manipulated the signing interface, making it display the correct wallet address while altering the underlying smart contract logic.