Key Takeaways
- The Bybit hacker has successfully laundered all 499,000 ETH within 10 days.
- Most of the stolen funds were funneled through ThorChain and converted into Bitcoin.
- Bybit has paid $4.3 million in bounties and managed to freeze 3% of the stolen ETH.
By Tuesday, March 4, North Korea’s Lazarus Group had laundered the entire 499,000 ETH stash from the $1.4 billion Bybit exploit.
Unlike most hacks, where stolen funds often remain dormant for years before being laundered, the Bybit attackers wasted no time dispersing the assets across decentralized finance (DeFi) platforms and blockchain networks.
ThorChain and eXch Play Key Roles in Laundering
Instead of relying on traditional crypto mixers like Tornado Cash, which are often used to launder stolen funds, the hackers opted for a different approach.
The Lazarus group funneled a bulk of the stolen ETH through ThorChain, a decentralized cross-chain protocol that allows users to swap assets between blockchains without intermediaries.
According to Bybit CEO Ben Zhou , approximately 361,255 ETH (worth $900 million) was moved through ThorChain, where it was converted into Bitcoin (BTC).
The surge in activity contributed to a $5.9 billion spike in ThorChain’s trading volume, generating $5.5 million in transaction fees for the platform.
The state-sponsored hackers laundered 79,655 ETH (about 6% of the stolen funds) via eXch’s decentralized mixer .
Despite Bybit’s requests, the platform refused to cooperate with authorities or freeze funds.
Finally, the Bybit attackers routed the remaining 40,233 ETH ($100 million) through OKX’s Web3 proxy.
While some funds remain traceable, Bybit has acknowledged that 20% of the stolen assets have gone completely dark, making a recovery increasingly difficult.
Bybit CEO Warns Exchanges To Monitor Stolen Funds
Zhou has urged crypto platforms, over-the-counter (OTC) desks, and peer-to-peer (P2P) markets to stay alert, warning that 83% of the stolen funds—now worth roughly $1 billion—have been converted into Bitcoin.
The stolen Bitcoin is now spread across 6,954 wallets, each holding an average of 1.71 BTC.
According to Zhou, the next few weeks are critical as these funds will likely begin flowing into exchanges and trading platforms.
Despite the scale of the attack, Bybit has taken aggressive steps to mitigate the damage.
The exchange has paid out $4.3 million in bounties to 18 individuals and organizations that assisted in tracking the stolen funds.
The top contributors include Mantle, Paraswap, and blockchain investigator ZachXBT.
Was this Article helpful?
