Michaela
The North Korean-affiliated Lazarus Group has allegedly fully laundered funds stolen in the recent Bybit hack, transferring 500,000 Ethereum (ETH) primarily into Bitcoin (BTC). Blockchain security analysts identify Lazarus Group as the main suspect behind the attack.
Blockchain security firm Arkham Intelligence reported that THORChain, a decentralized cross-chain liquidity protocol, has processed over $5.5 billion in transaction volume following the February 21 Bybit hack.
Bybit Co-founder and CEO, Ben Zhou, shared in a post on X that the hackers primarily utilized THORChain to convert ETH into BTC following the breach.
Despite surpassing $5 million in revenue, the THORChain protocol has come under scrutiny for its involvement in processing illicit transactions. On February 28, a developer known as “Pluto” resigned after a decision to block transactions linked to North Korean hackers was overturned.
On March 4, crypto commentator Yogi alleged in a post on X that THORChain played a role in laundering $605 million linked to North Korea. “No KYC, no off switch, no resistance. Lazarus Group hacked Bybit for $1.5 billion in February 2025, then funneled the stolen ETH through THORChain like it was built for them. Over five days, $2.91 billion in volume ripped through, $860 million in a single day, while THORChain pocketed $3 million in fees. That’s not innovation—that’s negligence at best, greed at worst,” Yogi wrote.
However, supporters of THORChain argue that, as an open-source and decentralized protocol, it operates independently and does not function as a law enforcement entity. “The only reason why people FEEL that Thorchain should censor transactions is the general FEELING that if they put enough pressure on Node Operators, they will buckle under pressure (which honestly can happen),” wrote Runemir, Chief Narrative Officer of Qi Capital, in an X post.
“Nobody is asking that from Bitcoin and Ethereum because it FEELS impossible,” he added.
Bybit Tracks Stolen Funds Linked to Lazarus Group with Community Help
The Bybit CEO shared that 77% of the stolen funds remain traceable, while 20% are unaccounted for, and 3% have been frozen.
Zhou disclosed that 417,348 ETH, valued at $1 billion, has been converted into Bitcoin (BTC) across 6,954 wallets, averaging 1.71 BTC per wallet. He also noted that 361,255 ETH, or $900 million (72%), was processed through THORChain, with transactions remaining traceable.
Furthermore, Zhou reported that 40,233 ETH, valued at $100 million (8%), was moved through the OKX Web3 proxy. Of this, 16,680 ETH remains traceable, while 23,553 ETH ($65 million or ~5%) is currently untraceable and would require additional data from OKX Web3 Wallet to track.
Eleven entities assisted Bybit in freezing the stolen funds, with Mantle, Paraswap, and ZachXBT playing key roles. A total of $2,178,797 USDT has been distributed to 11 bounty hunters for their contributions.
Bybit has introduced a tracking website to monitor the movement of its stolen funds and is offering a bounty to those who assist in freezing them.
So far, the platform has identified seven exchanges cooperating in the effort, while one—eXch, a no-Know Your Customer (KYC) swap service—has refused to freeze assets connected to the hack.
Read More
- Bybit Quest to Reclaim $1.3B: Chasing Hack Funds and ETH Rollback
- Lazarus Group Levels Up with Fake Blockchain Game in Crypto Heist
- Lazarus Group Exploits Google Chrome Zero-Day Vulnerability in Crypto Attack
Michaela has no crypto positions and does not hold any crypto assets. This article is provided for informational purposes only and should not be construed as financial advice. The Shib Magazine and The Shib Daily are the official media and publications of the Shiba Inu cryptocurrency project. Readers are encouraged to conduct their own research and consult with a qualified financial adviser before making any investment decisions.
