Bybit CEO: Two-thirds of Lazarus-hacked funds remain traceable

Crypto exchange Bybit co-founder and CEO Ben Zhou says more than two-thirds of the digital assets stolen from the platform in February by North Korea’s Lazarus Group still remain traceable. 

In an executive summary on hacked Bybit funds posted on X on April 21, Ben Zhou said that of the total $1.4 billion hacked, 68.6% “remains traceable,” 27.6% has “gone dark,” and 3.8% has been frozen.

The untraceable funds primarily flowed into mixers, then through bridges to peer-to-peer and over-the-counter platforms, he added. 

In February, hackers associated with the Lazarus Group exploited vulnerabilities in Bybit’s cold wallet infrastructure, stealing $1.4 billion in the largest crypto exchange hack to date.

“Recently, we have observed that the mixer mainly used by the DPRK [Democratic People's Republic of Korea] is Wasabi,” Zhou said before stating that following the Wasabi washing of BTC, “a small portion of it entered CryptoMixer, Tornado Cash, and Railgun.”

Zhou confirmed that 944 Bitcoin (BTC) worth around $90 million went through the Wasabi mixer. Multiple crosschain and swap services were carried out through platforms such as THORChain, eXch, Lombard, LI.FI, Stargate and SunSwap before the loot eventually entered P2P and OTC services, he added. 

Another 432,748 Ether (ETH), around 84% of the total worth roughly $1.21 billion, has been transferred from Ethereum to Bitcoin via THORChain. Around two-thirds of that — around $960 million worth of Ether — has been converted into 10,003 BTC across 35,772 wallets, he added. 

Around $17 million worth of Ether remains on the Ethereum blockchain across 12,490 wallets, Zhou reported. 

Zhou also revealed that only 70 of 5,443 bounty reports received over the past 60 days were valid. 

Bybit launched the Lazarus Bounty program in February, offering a total of $140 million in rewards for information leading to funds being frozen.

To date, it has paid out $2.3 million to 12 bounty hunters. Most of this went to one entity, the Mantle layer-2 platform, whose efforts resulted in $42 million worth of frozen funds. 

Related: Lazarus Group’s 2024 pause was repositioning for $1.4B Bybit hack

“We welcome more reports, we need more bounty hunters that can decode mixers, as we need a lot of help there down the road,” Zhou said. 

On April 17, the eXch crypto exchange announced it would cease operations on May 1 after reports alleged the firm was used to launder funds from the Bybit hack.

Magazine: Altcoin season to hit in Q2? Mantra’s plan to win trust: Hodler’s Digest