- Bybit CEO has stated that 20% of the $1.4B stolen from the trade is now untraceable.
- Hackers transformed $1B in ETH to BTC by way of THORChain and unfold it.
- To this point, 11 bounty hunters have assisted in freezing $42M of the stolen funds.
In a shocking replace, Bybit CEO Ben Zhou has revealed that $280 million of the $1.4 billion stolen from the cryptocurrency trade within the February hack has vanished into untraceable channels.
3.4.25 Govt Abstract on Hacked Funds:
Complete hacked funds of USD 1.4bn round 500k ETH, 77% are nonetheless traceable, 20% has gone darkish, 3% have been frozen.
Breakdown:
– 83% (417,348 ETH, ~$1B) have been transformed into BTC with 6,954 wallets (Common 1.71 btc every) . This and…— Ben Zhou (@benbybit) March 4, 2025
The safety breach, attributed to the North Korean hacking group Lazarus, noticed roughly 500,000 Ether (ETH) pilfered from Bybit’s reserves. Whereas the vast majority of the funds stays seen on the blockchain, Zhou’s announcement underscores the challenges dealing with investigators as they race towards time to freeze the belongings earlier than the hackers totally money out.
The assault exploited vulnerabilities in SafeWallet, a third-party pockets platform utilized by Bybit. Lazarus hackers compromised a developer’s machine, injecting malicious code that allowed them to siphon off practically $1.5 billion in ETH throughout a routine switch.
Regardless of Bybit’s swift motion to revive 1:1 backing of consumer belongings inside days, the hackers have been relentlessly shifting the stolen funds throughout a number of platforms, complicating restoration efforts.
Hackers leveraged THORChain to fragment funds
A good portion of the stolen Ether—417,348 ETH valued at round $1 billion—has been transformed into Bitcoin (BTC) and scattered throughout 6,954 wallets, every holding a median of 1.71 BTC.
Zhou famous that 72% of the haul, or 361,255 ETH value $900 million, was funneled by THORChain, a decentralized trade recognized for its privateness options.
THORChain alone processed a report $4.66 billion in swaps within the week ending March 2, raking in over $5.5 million in charges from these illicit transactions. This fragmentation and conversion technique has made monitoring the funds more and more tough for blockchain forensic groups.
In the meantime, 20% of the stolen belongings—roughly 79,655 ETH—have “gone dark,” that means they’ve been laundered by platforms like ExCH and rendered untraceable.
Zhou highlighted that a further 40,233 ETH, value $100 million, handed by OKX’s Web3 Proxy. Of this, 23,553 ETH ($65 million) stays untraceable with out additional cooperation from the OKX Pockets group, whereas 16,680 ETH continues to be inside attain of investigators.
The CEO pressured that the following one to 2 weeks are pivotal because the hackers put together to dump their haul by way of exchanges, over-the-counter (OTC) buying and selling desks, and peer-to-peer (P2P) networks.
Bybit has enlisted bounty hunters amid freezing efforts
In a bid to thwart the hackers, Bybit has enlisted the assistance of bounty hunters and safety corporations.
Zhou reported that 11 events—together with distinguished gamers like Mantle, Paraswap, and blockchain sleuth ZachXBT—have assisted in freezing $42 million, or 3% of the stolen funds.
To this point, Bybit has paid out $2.178 million in USDT to those contributors as a part of its restoration efforts, with extra particulars obtainable at Lazarusbounty.com. The trade additionally partnered with Web3 safety agency ZeroShadow on February 25 to boost its blockchain forensics and maximize asset restoration.
Regardless of these efforts, the hackers present no indicators of slowing down. Blockchain analytics agency Elliptic has recognized over 11,000 wallets linked to the Lazarus group, suggesting a sprawling community designed to obscure their tracks.
🚨 Free Actual-time Bybit Exploit Information 🚨
Elliptic has launched a free knowledge feed of illicit addresses linked to the Bybit exploit.
🔍 Why it issues:
✅ Reduce publicity to sanctions
✅ Cease laundering of stolen funds
✅ Strengthen crypto safetyEntry by way of CSV or API ⬇️… pic.twitter.com/U9Qa2tc8Zz
— Elliptic (@elliptic) February 25, 2025
Zhou indicated that a further $65 million in ETH could possibly be salvaged with OKX’s help, however time is operating out because the attackers proceed laundering operations by platforms like ExCH and OKX Web3 Proxy.
