ROME — The FBI has accused North Korean-linked hackers of conducting one of the largest thefts of cryptocurrency publicly known, seizing some $1.5 billion worth of ethereum from a Dubai-based firm.

The theft earlier this month targeting Bybit, one of the world’s largest crypto exchanges, represents yet another involving a team of hackers identified by the U.S. government by the names TraderTraitor and the Lazarus Group.

The hackers steal cryptocurrency “through the dissemination of cryptocurrency trading applications that were modified to include malware that facilitates theft of cryptocurrency,” the FBI has said.

In an online public service announcement late Wednesday, the FBI said it believed the North Korean-backed hackers were “responsible for the theft.”

“TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets to Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains,” the FBI said in its announcement. “It is expected these assets will be further laundered and eventually converted to fiat currency.”

North Korean state media has not acknowledged either the theft or the FBI accusation. Pyongyang’s mission to the United Nations in Geneva did not immediately respond to a request for comment from The Associated Press.

However, North Korea has stolen an estimated $1.2 billion in cryptocurrency and other virtual assets in the past five years, according to South Korea’s spy agency. It represents a rare source of badly needed foreign currency to support its fragile economy and fund its nuclear program in the face of intense U.N. sanctions and North Korea’s strict border closures during the coronavirus pandemic.

A U.N. experts panel separately said it was investigating 58 suspected cyberattacks by North Korea between 2017 to 2023 that saw some $3 billion stolen to “reportedly help to fund the country’s development of weapons of mass destruction.”

Bybit co-founder and CEO, Ben Zhou, acknowledged the FBI’s announcement in a post on the social platform X by linking to a website offering $140 million in bounties for tracking the stolen crypto and getting it frozen by other exchanges.

Bybit has said a routine transfer of ethereum, one of the most popular cryptocurrencies, from a so-called “cold” or offline wallet was “manipulated” by an attacker who transferred the crypto to an unidentified address. The blockchain analytics firm Certik has described the theft as “the largest breach” in the history of blockchain transactions.

The theft has seen overall crypto prices drop in recent days as investors in part have been spooked by the hack despite the industry getting a boost from the election of U.S. President Donald Trump. Industry leader Bitcoin traded over $82,000 a coin on Thursday, down from high of over $100,000 a month ago.

BANGKOK — China has slammed a decision by the U.S. Treasury to sanction a Beijing-based cybersecurity company for its alleged role in multiple hacking incidents targeting critical U.S. infrastructure.

Asked about the sanctions against Beijing-based Integrity Technology Group, Chinese Foreign Ministry spokesperson said the country has cracked down on cyber attacks and that Washington was using the issue to “defame and smear China.”

“For some time now, the U.S. side has been playing up so-called Chinese cyber attacks and has even initiated illegal unilateral sanctions against China,” said Guo Jiakun, a ministry spokesperson. “China firmly opposes this and will take necessary measures to safeguard its legitimate rights and interests.”

Integrity Technology Group said the move by Washington had “no factual basis.”

“The company firmly opposes the U.S. Treasury Department’s unwarranted accusations and Illegal unilateral sanctions on the company,” the company, also known as Yongxin Zhicheng Technology Group, said in a statement Monday to the Shanghai Stock Exchange.

On Friday, the Treasury’s Office of Foreign Assets Control hit Integrity Technology with sanctions that block access to U.S. property and bank accounts and prevent the targeted people and companies from doing business with Americans. It cited alleged multiple hacks against U.S. victims, including incidents attributed to Flax Typhoon, a Chinese state-sponsored campaign that targets U.S. critical infrastructure.

The sanctions did not appear to be related to an incident in which the Treasury Department reported that Chinese hackers had remotely accessed several of its workstations and unclassified documents in a major breach of cybersecurity.

The Treasury Department said it learned of that problem on Dec. 8, when a third-party software service provider, BeyondTrust, flagged that hackers had stolen a key “used by the vendor to secure a cloud-based service used to remotely provide technical support” to workers.

U.S. officials are grappling with the fallout from a massive Chinese cyberespionage blitz known as Salt Typhoon that they say gave officials in Beijing access to private texts and phone conversations of an unknown number of Americans.

Late last month, officials said at least eight telecommunications companies, as well as dozens of nations, had been affected by Salt Typhoon.

Integrity Technology said the sanctions would not adversely affect its business since it does not operate in the U.S. and has no assets there. It added that it abides by all laws and regulations and that it “has always adhered to the corporate vision and mission of bringing a sense of security to the world.”

WASHINGTON — A ninth U.S. telecoms firm has been confirmed to have been hacked as part of a sprawling Chinese espionage campaign that gave officials in Beijing access to private texts and phone conversations of an unknown number of Americans, a top White House official said Friday.

Biden administration officials said this month that at least eight telecommunications companies, as well as dozens of nations, had been affected by the Chinese hacking blitz known as Salt Typhoon.

But Anne Neuberger, the deputy national security adviser for cyber and emerging technologies, told reporters Friday that a ninth victim had been identified after the administration released guidance to companies about how to hunt for Chinese culprits in their networks.

The update from Neuberger is the latest development in a massive hacking operation that has alarmed national security officials, exposed cybersecurity vulnerabilities in the private sector and laid bare China’s hacking sophistication.

The hackers compromised the networks of telecommunications companies to obtain customer call records and gain access to the private communications of “a limited number of individuals.” Though the FBI has not publicly identified any of the victims, officials believe senior U.S. government officials and prominent political figures are among those whose whose communications were accessed.

Neuberger said officials did not yet have a precise sense how many Americans overall were affected by Salt Typhoon, in part because the Chinese were careful about their techniques, but a “large number” were in the Washington-Virginia area.

Officials believe the goal of the hackers was to identify who owned the phones and, if they were “government targets of interest,” spy on their texts and phone calls, she said.

The FBI said most of the people targeted by the hackers are “primarily involved in government or political activity.”

Neuberger said the episode highlighted the need for required cybersecurity practices in the telecommunications industry, something the Federal Communications Commission is to take up at a meeting next month.

“We know that voluntary cyber security practices are inadequate to protect against China, Russia and Iran hacking of our critical infrastructure,” she said.

The Chinese government has denied responsibility for the hacking.