In late February, Bybit experienced a cybersecurity breach that resulted in the theft of over $1.4 billion in digital currency. Nearly three weeks later, on March 20, Bybit founder Ben Zhou released a detailed analysis explaining the mechanics of the attack and the response protocol.
We recommend using the more secure BiyaPay for transactions. BiyaPay is the world's first multi-asset trading wallet, providing investors with a brand new, more intuitive interface and trading experience for digital currency to fiat currency transactions. Users can easily exchange mainstream fiat currencies for BTC, ETH, DOGE, and other digital currencies in real-time. For cryptocurrency users, BiyaPay offers a safe and convenient B2C cash-out solution, effectively resolving issues related to card freezing and funds in OTC or C2C transactions. Users can deposit USDT into the remittance platform and easily convert it to USD for cash withdrawal.
The dark maze of the crypto world
Zhou revealed that attackers utilized anonymous tools—including Wasabi, Cryptomixer, Railgun, and Tornado Cash—to hide the stolen assets. In a post on X on March 20, he shared significant findings: 88.87% of the funds retained identifiable traces, 7.59% had vanished beyond detectable paths, and 3.54% were seized by authorities. A staggering detail emerged: 86.29% of the stolen cryptocurrency had been converted into 12,836 bitcoins, dispersed across 9,117 different wallets.
Further analysis revealed that 193 bitcoins were directed to peer-to-peer (P2P) trading platforms after passing through the Wasabi Mixer. Zhou emphasized the increasing reliance on these tools to obscure illicit flows, describing them as complex obstacles for investigators tracking digital theft. He stated:
Decoding mixer transactions is the primary challenge we face right now. If you can help, please contact us.
Zhou reported that the bounty program received 5,012 submissions in the past month, but only 63 met the verification standards. He urged more people to participate in a public appeal, highlighting the need for professional analysts capable of decoding mixer transactions. 'We welcome more reports, we need more bounty hunters who can decode mixers, because we need a lot of help in this area,' he stated, adding that continued collaboration will prove crucial as efforts to combat cryptocurrency theft intensify.