Source: The Block
Bybit's CEO Ben Zhou stated that 27.59% of the $1.4 billion in stolen funds has 'disappeared.' These untraceable funds flowed into mixers and were then transferred to peer-to-peer and over-the-counter trading platforms through bridging.
In a recent post on the social media platform X, Zhou noted that of the $1.4 billion in cryptocurrency stolen from Bybit, 27.59% of the funds has 'disappeared.' This proportion of missing funds has increased since Zhou's update on March 4, when he stated that 77% of the funds were still traceable. In the latest summary, Zhou mentioned that 68.57% of the stolen cryptocurrency remains traceable, with only 3.84% of the funds frozen.
Zhou wrote, "The untraceable funds primarily flowed into mixers and were then transferred to P2P (peer-to-peer) and OTC (over-the-counter) platforms through bridging."
Incident Background
On February 21, Bybit experienced the largest hack in the history of centralized crypto exchanges, attributed to a targeted malware attack by the North Korean-supported hacker group Lazarus Group. This attack resulted in the exchange losing approximately 400,000 ETH and about 113,000 ETH-related tokens.
In an update on Monday, Zhou stated that hackers primarily used the Bitcoin mixer Wasabi to launder the stolen tokens into BTC, after which these funds were dispersed into platforms like CryptoMixer, Tornado Cash, and Railgun.
Zhou continued, "Subsequently, multiple cross-chain and exchange services were conducted through platforms like Thorchain, eXch, Lombard, LiFi, Stargate, and SunSwap. Eventually, these funds entered OTC or P2P fiat trading services."
According to Zhou's data, approximately $960.3 million in ETH is dispersed across 35,772 wallets, converted to 10,003 BTC, while 1.17% of the funds remain in 12,490 wallets on the Ethereum network.
Zhou also encouraged on-chain bounty hunters to help freeze the stolen funds, stating that among 5,443 bounty reports in the past 60 days, 70 were considered valid. According to the page, Bybit will reward bounty hunters with 10% of the recovered funds and has already disbursed $2.3 million in rewards to 12 hunters.
eXch ceases operations
Meanwhile, eXch, the privacy-oriented crypto trading platform mentioned in Zhou's post, recently announced it will cease operations on May 1, due to the 'Transatlantic Operation' suing the project over money laundering charges related to Lazarus.
Although eXch did not admit that its platform was used by Lazarus to mix the stolen cryptocurrency from Bybit, it stated that the project had to compromise its privacy ideals as the entire industry faced immense pressure due to Bybit's irresponsible behavior.
After reports indicated that Bybit funds were transferred through decentralized protocols, Chainflip DEX temporarily paused its platform to deploy upgrades preventing hacker usage.
THORChain, a cross-chain liquidity protocol primarily utilized by Lazarus, decided after internal discussions not to take measures to block certain users, resulting in the departure of some members.
