Michaela
Bybit CEO Ben Zhou has revealed that more than two-thirds of the $1.4 billion stolen in a February cyberattack have remained traceable, as the exchange ramps up efforts to recover the funds.
In an update on X, Zhou informed the community that nearly 70% of the stolen funds “remain traceable.” He revealed that 27.6% of the funds have disappeared from view, while 3.8% have been frozen. The untraceable portion of the stolen assets largely passed through mixers before moving to peer-to-peer (P2P) and over-the-counter (OTC) platforms via cross-chain bridges.
“Recently, we have observed that the mixer mainly used by the DPRK [Democratic People’s Republic of Korea] is Wasabi. After a certain amount of BTC was washed through Wasabi, a small portion of it entered CryptoMixer, Tornado Cash and Railgun,” Zhou wrote. “Then, multiple cross-chain and swap services were carried out through platforms such as Thorchain, eXch, Lombard, LiFi, Stargate, and SunSwap,” he added.
Zhou detailed that 944 Bitcoin, valued at approximately $90 million, passed through the Wasabi mixer. The stolen funds then moved through several cross-chain platforms, including THORChain, eXch, Lombard, LI.FI, Stargate, and SunSwap, before being funneled into P2P and OTC.
Nearly 84% of the stolen crypto, totaling 432,748 Ether and valued at approximately $1.21 billion, has been shifted from Ethereum to Bitcoin through THORChain, according to Zhou. Of that amount, roughly two-thirds—equivalent to $960 million—was converted into 10,003 BTC and distributed across 35,772 wallets. Zhou also noted that approximately $17 million in Ether remains on the Ethereum blockchain, still held in 12,490 wallets.
In the past 60 days, Bybit has received 5,443 bounty reports following the launch of its Lazarus Bounty program, designed to track the funds stolen by the North Korean-linked Lazarus Group. Of these submissions, 70 were deemed valid.
Bybit rolled out its bounty program in February, pledging up to $140 million in rewards for information that could lead to the freezing of hacked funds. So far, the exchange has paid out $2.3 million across 12 successful claims—most notably to the Mantle layer-2 platform, which played a key role in freezing $42 million worth of assets linked to the breach.
“We welcome more reports, we need more bounty hunters that can decode mixers as we need a lot of help there down the road,” Zhou stated.
Read More
- North Korea’s Lazarus Group Expands Crypto Holdings After Bybit Hack
- OKX Denies EU Probe Amid Claims of Bybit Hack Funds Laundering
- Bybit Hack: Investigators Track 11K Wallets Linked to Lazarus Group
Michaela has no crypto positions and does not hold any crypto assets. This article is provided for informational purposes only and should not be construed as financial advice. The Shib Magazine and The Shib Daily are the official media and publications of the Shiba Inu cryptocurrency project. Readers are encouraged to conduct their own research and consult with a qualified financial adviser before making any investment decisions.
