Two months after the Bybit hack, the exchange’s Chief Executive Officer, Ben Zhou, disclosed that 27.59% of the $1.4 billion stolen funds has disappeared.
Explaining what have happened, he shared that the untraceable funds were mainly funneled through mixers, then moved across bridges to peer-to-peer (P2P) and over-the-counter (OTC) platforms.
CEO: $390 Million have ‘Gone Dark’
In an X post, Zhou shared that out of the total stolen funds, 68.57%, or around $960 million, are traceable; 27.59%, or around $390 million, are untraceable; and 3.84%, or approximately $54 million are frozen.
He noted that Wasabi was the primary mixer used by the Democratic People’s Republic of Korea. He also pointed out that after a portion of $BTC was processed through Wasabi, it was partially funneled into CryptoMixer, Tornado Cash, and Railgun.
Subsequently, the funds were moved through various cross-chain and swap services, including platforms like Thorchain, eXch, Lombard, LiFi, Stargate, and SunSwap, before ultimately entering OTC or P2P fiat currency exchanges.
Funds Whereabouts
Ethereum $ETH
- 432,748 $ETH (84.45%, ~$1.21 billion) was transferred from $ETC to $BTC via Thorchain.
- 342,975 $ETH (67.25%, ~$960.33 million) was converted into 10,003 $BTC across 35,772 wallets.
- 5,991 $ETH (1.17%, ~$16.77 million) remains $ETH across 12,490 wallets.
Bitcoin $ETH
- 944 $BTC (6.34%, ~$90.62 million) went to Wasabi Mixer.
- 531 $BTC (3.57%,~$49.52 million ) was transferred from $BTC to $ETC via Thorchain.
Prior to this, it was previously reported that North Korean hackers, linked to the Lazarus Group, already laundered $300 million of the stolen funds from Bybit. Despite efforts to track and recover the funds, 20% of the stolen assets have already “gone dark,” making them nearly impossible to reclaim.
Bounty Update
“In the past 60 days, 5,443 bounty reports were received of which 70 were valid bounty reports. We welcome more reports, we need more bounty hunters that can decode mixers as we need a lot of help there down the road.”
Ben Zhou, Chief Executive Officer, Bybit
The Lazarus Bounty Program is an initiative launched by Bybit to help trace, freeze, and recover stolen funds linked to the Lazarus Group, a North Korean state-backed hacker group.
Participants, known as “bounty hunters,” can earn rewards by reporting suspicious transactions and tracing the movement of stolen funds. The program offers a 10% reward—5% for successfully freezing stolen funds and 5% for tracing and identifying the funds. Rewards are given upfront upon fund freezing.
To participate, users must connect their wallets, track stolen funds using real-time data, and submit verified reports. The program also encourages cooperation from exchanges and mixers to block illicit transactions.
Recent Bybit Hack News
Last month, Bybit’s market share dropped from nearly 20% to just 5%, while Binance saw its dominance rise to 62%.
Although Bybit’s market share partially recovered to 9.04%, at that time, the platform continued to face reputational damage and trust issues.
It was after in February, Bybit became the victim of the largest crypto hack in history, which exploited a vulnerability in Bybit’s cold wallet transfer process, allowing hackers to manipulate contract logic and drain funds. The stolen assets were laundered through various methods, including meme coins and cross-chain bridges.
Check the Timeline here as covered by BitPinas: Bybit Hack Update Timeline: North Korea’s Lazarus Group Responsible for Largest Crypto Hack in History
Locally, Paolo Dioquino of DeFi Philippines rejected the idea of an Ethereum rollback after the $1.46 billion Bybit hack, explaining that the exploit targeted Bybit’s interface, not Ethereum. While BayaniChain CEO Paul Soliman noted that it was a social engineering attack that exploited human error, not the blockchain’s security.
This article is published on BitPinas: $390M in Stolen Bybit Crypto ‘Gone Dark,’ CEO Confirms Use of Mixers and P2P Laundering
What else is happening in Crypto Philippines and beyond?
