Bybit Hack Update: $1B in Stolen ETH Still Traceable as Laundering Efforts Continue
Over 77% of the funds stolen in the record-breaking hack of crypto exchange Bybit remain traceable, while approximately 20% have been successfully laundered and are now untraceable, CEO Ben Zhou reported on X early Tuesday.
“The next week is crucial for freezing stolen funds as they begin to clear through exchanges, OTC desks, and P2P channels,” Zhou warned, highlighting the hackers’ ongoing efforts to cash out the stolen assets.
Currently, 417,348 ether (ETH), valued at around $1 billion, remains trackable on the blockchain, despite being moved through privacy-centric THORChain. Meanwhile, roughly 79,655 ETH (~$200 million) has “gone dark” after being funneled through ExCH, making further tracking difficult.
A smaller portion—40,233 ETH ($100 million)—was routed through OKX’s Web3 proxy, but of that, only 23,553 ETH ($65 million) is now fully untraceable.
According to Zhou, the attackers converted 83% of the stolen ETH—equivalent to 361,255 ETH (~$900 million)—into BTC, distributing it across 6,954 wallets via THORChain, with each wallet holding an average of 1.71 BTC.
THORChain facilitated a record $4.66 billion in swaps in the week ending March 2, per DefiLlama data, generating over $5.5 million in fees from illicit transactions.
The hack, attributed to North Korea’s Lazarus Group, exploited a vulnerability in SafeWallet, a third-party wallet service integrated with Bybit. Attackers compromised a developer’s device, injecting malicious code that enabled them to divert nearly $1.5 billion in ETH from user funds.
Despite the breach, Bybit quickly restored full 1:1 asset backing, as previously reported by CoinDesk. Blockchain data suggests that more than $400 million was acquired via OTC desks, while another $300 million was sourced directly from crypto exchanges to cover user balances.
