Over $380 Million in Cryptocurrency Stolen in $1.4 Billion Bybit Hack Remains Untraceable
According to Zhou, the untraceable assets were mainly directed to mixers and then through bridges to P2P and OTC platforms.
Omkar Godbole | Edited by Parikshit Mishra , April 21, 2025, 5:24 AM.
Key points:
- Bybit CEO says 27.95% of the $1.4 billion lost in the North Korean hack carried out by the Lazarus group is untraceable.
- The stolen assets were moved through mixers and cross-chain exchanges to cover their tracks.
- Of the total stolen funds, 84.45% were converted from Ether to Bitcoin, with a significant portion being spread across thousands of wallets.
Ben Zhou, CEO of cryptocurrency exchange Bybit, said 27.95% of the funds lost in a $1.4 billion attack by North Korean group Lazarus have gone missing or become untraceable.
“The total amount of stolen funds is 1.4 billion US dollars, equivalent to about 500 thousand ETH. 68.57% remain traceable, 27.59% disappeared, 3.84% were frozen. The untraceable funds were mainly moved to mixers and then through bridges to P2P and OTC platforms,” Zhou said in a brief post published on X on Monday.
The untraceable funds were transferred to mixers and then routed through bridges to P2P (peer-to-peer) and OTC (over-the-counter) platforms. The report also mentions the use of the crypto mixer Wasabi to launder a certain amount of BTC, some of which were then routed to other mixers such as Railgun, Tornado Cash, and CryptoMixer.
The attacker then carried out several cross-chain swaps through Thorchain, eXch, Lombard, LiFi, Stargate and SunSwap, and in the final stage, these illegal funds were converted into more liquid assets.
The North Korean-linked Lazarus group hacked Bybit in February, stealing 500,000 ether (ETH) by gaining “control of a specific ETH cold wallet and transferring all ETH from the cold wallet to this unidentified address.”
Forensic analysis shows that of the stolen funds, a total of 432,748 ETH, or 84.45%, were converted from Ether to Bitcoin via Thorchain. Notably, 67.25% of these funds, equal to 342,975 ETH (approximately $960.33 million), were converted into 10,003 BTC and distributed across 35,772 wallets with an average value of 0.28 BTC per wallet.
Additionally, 1.17% of the funds, or 5,991 ETH (approximately $16.77 million), remain on the Ethereum blockchain, located in 12,490 wallets.
Finally, the Lazarus Bounty initiative received 5,443 bounty claims in two months, of which 70 were considered valid. Zhou noted that the exchange needs “more bounty hunters who can decode mixers, as we will need a lot of help in this area in the future.”
