About 27.59% of the $1.4 billion worth of crypto stolen from Bybit exchange has "gone dark," CEO Ben Zhou said in his latest post on social media platform X.
The portion of funds that disappeared from Bybit's radar has increased since Zhou's March 4 update, when he said 77% of the funds remained traceable. In the latest summary, Zhou said that 68.57% of the stolen crypto is still traceable, while only 3.84% has been frozen.
"The untraceable funds primarily flowed into mixers then through bridges to P2P (peer-to-peer) and OTC (over-the-counter) platforms," Zhou wrote.
On Feb. 21, Bybit suffered the largest-ever hack on a centralized crypto exchange, attributed to a targeted malware attack by North Korea-backed hacker organization Lazarus Group. As a result, the exchange lost around 400,000 ETH and about 113,000 ETH-related tokens.
In the Monday update, the Bybit CEO said the hackers were mainly using bitcoin mixer Wasabi to launder stolen tokens into BTC, after which they were scattered to enter platforms CryptoMixer, Tornado Cash and Railgun.
"Then, multiple cross-chain and swap services were carried out through platforms such as Thorchain, eXch, Lombard, LiFi, Stargate and SunSwap," Zhou said. "Eventually, it entered OTC or P2P fiat currency exchange services."
About $960.3 million worth of ETH has been scattered across 35,772 wallets after being converted into 10,003 BTC, while 1.17% of the funds remain on the Ethereum network across 12,490 wallets, according to Zhou.
Zhou also encouraged onchain bounty hunters to help freeze stolen funds, saying that 70 out of 5,443 bounty reports in the past 60 days were found valid. According to the page, Bybit says it will reward bounty hunters with 10% of recovered funds and has already awarded $2.3 million to 12 hunters.
Meanwhile, eXch, a privacy-focused crypto trading platform that was mentioned in Zhou's post, recently announced that it will cease operations as of May 1, due to a "transatlantic operation" to prosecute the project for money laundering charges linked to Lazarus.
Although eXch did not acknowledge Lazarus' use of the platform to mix stolen crypto from Bybit, it lamented that projects had to compromise their privacy ideals "under the immense pressure that the whole industry had to deal with due to the irresponsible actions of those at ByBit."
After reports of Bybit funds being funneled through decentralized protocols, Chainflip DEX temporarily halted its platform to deploy an upgrade that prevents hackers from using the platform.
THORChain, a cross-chain liquidity protocol that was mainly utilized by Lazarus, decided not to place such measures to block out some users despite internal discussions, which resulted in the departure of some of its members.
Disclaimer: The Block is an independent media outlet that delivers news, research, and data. As of November 2023, Foresight Ventures is a majority investor of The Block. Foresight Ventures invests in other companies in the crypto space. Crypto exchange Bitget is an anchor LP for Foresight Ventures. The Block continues to operate independently to deliver objective, impactful, and timely information about the crypto industry. Here are our current financial disclosures.
© 2025 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
