Only 3.84% of $1.4B in Hacked Crypto Frozen, Reveals ByBit CEO
In a stark revelation, ByBit CEO Ben Zhou confirmed that just 3.84% of the staggering $1.4 billion in crypto assets stolen by North Korea’s Lazarus Group has been successfully frozen. The remaining majority continues to move stealthily across decentralized platforms, mixers, and OTC networks, obscuring its digital footprints.
ByBit’s forensic audit traces the original theft to 500,000 ETH, with about 68.57% still traceable. However, 27.59% has vanished, aided by rapid fragmentation, chain-hopping, and privacy tools designed to evade detection.
The trail shows extensive laundering: funds first passed through mixers like Wasabi, Tornado Cash, CryptoMixer, and Railgun before diving into cross-chain swaps via Thorchain, LiFi, Stargate, and others. From there, they entered the murky waters of P2P and OTC fiat ramps, leaving investigators chasing thousands of micro-wallets.
ByBit tracked 432,748 ETH—about 84.45% of the stolen amount—converted to 10,003 BTC, now dispersed across 35,772 wallets, each averaging just 0.28 BTC. Only 5,991 ETH (1.17%) remains on Ethereum, split across 12,490 addresses with minimal balances.
The laundering cycle has mirrored moves in reverse, with 944 BTC funneled through Wasabi and 531 BTC bridged back to Ethereum. These tactics exploit gaps in cross-chain surveillance, highlighting how attackers stay one step ahead.
Crowdsourced initiative Lazarusbounty.com has received over 5,400 tips in two months, yet only 70 were valid. The platform urges more participation, especially from those able to decode advanced mixing activity.
Despite the complexity, Zhou remains hopeful: “Nearly two-thirds of the funds are still on-chain. With global coordination across exchanges, bridges, and fiat gateways, more freezes are possible.”
But for now, the Lazarus-linked war chest remains largely in motion—an alarming signal of just how vulnerable the decentralized ecosystem remains to sophisticated cybercrime.
Follow
@Rosy Ruma