Bybit’s Stolen Funds Move Through Crypto Mixers Amid DEX Crackdown

Key Takeaways

• Bybit stolen funds are currently being laundered using crypto mixer services such as Tornado Cash and Wasabi.
• Bybit hackers stole $1.4 billion worth of ETH and converted 88% of it into Bitcoin.
• Bybit CEO called upon bounty hunters to decode mixer transactions.

After initially swapping most of the stolen 500,000 ETH for Bitcoin via decentralized exchanges (DEXs), Hackers behind the $1.4 billion Bybit hack are now funneling BTC through popular crypto mixers to obscure their transactions.

Bybit CEO Ben Zhou has called on bounty hunters to help decode mixer transactions, warning that the hackers will likely continue laundering.

The exchange is now racing against time to recover assets before they fully disappear into the blockchain’s shadows.

Bybit Hacker Starts Laundering $1B Proceed Via Mixers

Bybit CEO Ben Zhou revealed that the hackers are now using privacy-focused tools, including Wasabi, CryptoMixer, Railgun, and Tornado Cash, to cover their transactions.

According to Zhou, 86.29% of the stolen funds—440,091 ETH worth $1.23 billion—were converted into 12,836 BTC and distributed across 9,117 wallets, with an average balance of 1.41 BTC per wallet.

The hackers have started funneling these Bitcoin holdings through mixers.

In one instance, 193 BTC linked to the hackers was sent through Wasabi Mixer before being redistributed to various peer-to-peer (P2P) vendors—a common laundering technique.

The FBI has linked the attack to the North Korean hacker group Lazarus, but unlike their previous exploits, they initially avoided using crypto mixers.

Instead, they first converted the stolen ETH into Bitcoin and small amounts of memecoins before moving to mixing services, suggesting a shift in laundering tactics.

Bybit CEO Calls for Bounty Hunters to Track Stolen Funds

As the laundering process continues, Bybit is actively recruiting blockchain analysts and bounty hunters to help trace and freeze the stolen assets.

“Decoding mixer transactions is the No. 1 challenge we face now. If you can help, please reach out,” Zhou said.

So far, 5,012 bounty reports have been submitted, but only 63 have been deemed valid. Bybit is urging more experts to come forward, emphasizing that tracking funds through mixers is the biggest hurdle in the recovery effort.

According to Zhou, the current status of the stolen funds is as follows:

• 88.87% remain traceable.
• 7.59% have gone dark.
• 3.54% have been frozen.