BitoPro exchange links Lazarus hackers to $11 million crypto heist

BitoPro disclosed that on May 8, 2025 a Lazarus-attributed intrusion used social engineering and a malware implant on a cloud operator's device to hijack AWS session tokens, bypass MFA, and inject scripts into hot-wallet infrastructure; attackers stole roughly $11 million across Ethereum, Tron, Solana, and Polygon and laundered funds via DEXs and mixers. The compromise occurred during a hot-wallet update, was later detected and remediated by rotating keys and replenishing hot wallets, and an external investigation concluded there was no internal collusion.