According to CoinDesk, over 77% of the funds stolen in a significant hack on the crypto exchange Bybit remain traceable, while 20% have become untraceable, as reported by CEO Ben Zhou. In an update shared on X early Tuesday, Zhou emphasized the importance of the current and upcoming week for freezing these funds as they begin to clear through exchanges, over-the-counter (OTC) platforms, and peer-to-peer (P2P) networks. The hackers are reportedly attempting to launder the stolen money and convert it into cash.
Approximately 417,348 ether (ETH), valued at around $1 billion, remain traceable on the blockchain after being moved using the privacy-focused THORChain. However, about 20% of the funds, equivalent to roughly 79,655 ETH or $200 million, have "gone dark" through ExCH. A smaller portion, 40,233 ETH or $100 million, passed through OKX’s web3 proxy, but 23,553 ETH, worth $65 million, remain untraceable.
Zhou revealed that the hackers converted 83% of the stolen ETH — 361,255 ETH, or $900 million — into Bitcoin (BTC), distributing it across 6,954 wallets, with an average of 1.71 BTC per wallet using THORChain. THORChain has processed $4.66 billion in swaps in the week ending March 2, marking the highest tally on record, according to data from DefiLlama, generating over $5.5 million in fees from these illicit flows.
The North Korean hacking group Lazarus targeted Bybit in late February by injecting malicious code into SafeWallet, a third-party wallet platform used by the exchange, to steal billions in customer assets. The attackers compromised a developer’s device, allowing them to manipulate a routine wallet transfer and siphon off nearly $1.5 billion in ETH.
Bybit managed to fully restore a 1:1 backing of client assets days after the attack, as previously reported by CoinDesk. Address activity indicates that more than $400 million were purchased through over-the-counter trading, with an additional $300 million acquired directly from exchanges.
