Key Takeaways
- The Bybit hacker has successfully laundered all 499,000 ETH within 10 days.
- Most of the stolen funds were funneled through ThorChain and converted into Bitcoin.
- Bybit has paid $4.3 million in bounties and managed to freeze 3% of the stolen ETH.
By Tuesday, March 4, North Korea’s Lazarus Group had laundered the entire 499,000 ETH stash from the $1.4 billion Bybit exploit.
Unlike most hacks, where stolen funds often remain dormant for years before being laundered, the Bybit attackers wasted no time dispersing the assets across decentralized finance (DeFi) platforms and blockchain networks.
ThorChain and eXch Play Key Roles in Laundering
Instead of relying on traditional crypto mixers like Tornado Cash, which are often used to launder stolen funds, the hackers opted for a different approach.
The Lazarus group funneled a bulk of the stolen ETH through ThorChain, a decentralized cross-chain protocol that allows users to swap assets between blockchains without intermediaries.
According to Bybit CEO Ben Zhou, approximately 361,255 ETH (worth $900 million) was moved through ThorChain, where it was converted into Bitcoin (BTC).
The surge in activity contributed to a $5.9 billion spike in ThorChain’s trading volume, generating $5.5 million in transaction fees for the platform.
The state-sponsored hackers laundered 79,655 ETH (about 6% of the stolen funds) via eXch’s decentralized mixer.
Despite Bybit’s requests, the platform refused to cooperate with authorities or freeze funds.
Finally, the Bybit attackers routed the remaining 40,233 ETH ($100 million) through OKX’s Web3 proxy.
While some funds remain traceable, Bybit has acknowledged that 20% of the stolen assets have gone completely dark, making a recovery increasingly difficult.
Bybit CEO Warns Exchanges To Monitor Stolen Funds
Zhou has urged crypto platforms, over-the-counter (OTC) desks, and peer-to-peer (P2P) markets to stay alert, warning that 83% of the stolen funds—now worth roughly $1 billion—have been converted into Bitcoin.
The stolen Bitcoin is now spread across 6,954 wallets, each holding an average of 1.71 BTC.
According to Zhou, the next few weeks are critical as these funds will likely begin flowing into exchanges and trading platforms.
Despite the scale of the attack, Bybit has taken aggressive steps to mitigate the damage.
The exchange has paid out $4.3 million in bounties to 18 individuals and organizations that assisted in tracking the stolen funds.
The top contributors include Mantle, Paraswap, and blockchain investigator ZachXBT.
Prashant Jha is a seasoned crypto journalist based in Delhi, India, with a Bachelor’s Degree in Computer Science Engineering. Passionate about the evolving world of blockchain and cryptocurrencies, he has been a dedicated voice in the industry since 2018. Prashant’s expertise lies in regulatory reporting, where he unravels complex legal and financial developments with clarity and precision. Before joining CCN in 2024, he honed his craft at Cointelegraph, establishing himself as a trusted name in crypto journalism.
His coverage spans major industry events, including the high-profile collapses of FTX, Three Arrows Capital (3AC), and LUNA, offering readers insightful analyses of their regulatory and market implications. Prashant’s technical background enables him to bridge the gap between intricate blockchain technology and its real-world applications, making his work accessible to novices and experts.
Beyond his professional pursuits, Prashant is an avid music enthusiast, often exploring diverse genres to unwind. A sports lover, he has a particular passion for cricket and frequently engages in discussions about the game. His multifaceted interests and sharp journalistic instincts make him a valuable contributor to CCN, where he continues shaping the crypto landscape's narrative.
