Skip to content
- Bybit has tracked $960M in stolen funds after a $1.4B hack in February, with 70% still traceable; it has frozen 3.8%, while 27.6% has become untraceable.
- THORChain used to launder $1.2B, converting 432,748 ETH into BTC and spreading it across 35,772 wallets.
- Bybit’s $140M Lazarus Bounty prompted authorities to freeze $42M in assets and distribute 12 payouts totaling $2.3M; users have submitted 5,443 tips so far.
Bybit CEO Ben Zhou has revealed that nearly 70% of the $1.4 billion stolen in a February cyberattack remains traceable, offering a glimmer of hope in the race to recover the missing funds.
Taking to social platform X, Zhou shared detailed insights into the movement of the stolen assets, indicating that 27.6% of the funds have been effectively laundered through various tools and are currently untraceable, while 3.8% has been successfully frozen. The traceable portion, however, is still under close surveillance by Bybit and its investigative partners.
Zhou’s post pulled back the curtain on a complex laundering trail that stretched across the blockchain ecosystem. The breakdown shows that 944 Bitcoin, worth around $90 million, moved through Wasabi, a privacy-focused mixer. The North Korean Lazarus Group, a state-sponsored hacking collective linked to the breach, reportedly favors this tool.
Bybit Tracks $1.2B Laundered via THORChain
“Recently, we have observed that the mixer mainly used by the DPRK is Wasabi,” Zhou explained. “After laundering a certain amount of BTC through Wasabi, the hackers moved a small portion into CryptoMixer, Tornado Cash, and Railgun.” He added that once the funds exited mixers, they were routed through a labyrinth of cross-chain and swap protocols, including THORChain, eXch, Lombard, LI.FI, Stargate, and SunSwap, before finally reaching peer-to-peer (P2P) and over-the-counter (OTC) platforms.
Perhaps the most notable finding is the scale of laundering through THORChain. Zhou stated that the hackers shifted nearly 84% of the stolen assets, 432,748 Ether worth about $1.21 billion, from Ethereum to Bitcoin using THORChain.
From there, approximately two-thirds of the total stolen amount (around $960 million) was converted into 10,003 BTC and distributed across a sprawling network of 35,772 wallets, highlighting the sophistication and reach of the laundering operation.
Furthermore, not all funds have escaped scrutiny. Zhou noted that approximately $17 million in Ether remains dormant on Ethereum, currently sitting in 12,490 wallets.
Bybit Launches $140M Bounty to Track Stolen Assets
To accelerate recovery efforts, Bybit launched the Lazarus Bounty program in February, offering up to $140 million in rewards for information leading to the identification or freezing of stolen assets. Since then, the exchange has received 5,443 bounty submissions, with 70 reports deemed actionable. Among the most significant wins: $42 million in frozen assets, thanks in part to assistance from the Mantle layer-2 platform.
To date, Bybit has paid out $2.3 million across 12 claims, and Zhou is calling for reinforcements. “We welcome more reports,” he said. “We need more bounty hunters that can decode mixers, as we need a lot of help there down the road.”
The investigation has turned the case into a striking example of the challenges in digital asset forensics. At the same time, it highlights the field’s evolving capabilities in an increasingly complex, cross-chain environment.
Related | Ethereum Under Pressure as Peter Brandt Warns of Potential Drop to $800
