Bybit CEO Confirms 68% of Stolen Funds from February’s $1.4 Billion Hack Remain Traceable

Highlights:

• Bybit CEO Ben Zhou confirms 27.59% of stolen funds remain untraceable after hack.
• Lazarus Group utilized mixers, bridges, and P2P platforms to move stolen funds.
• eXch privacy platform to shut down amid money laundering links to Lazarus Group.

Crypto exchange Bybit co-founder and CEO Ben Zhou provided an update on the February hack by North Korea’s Lazarus Group, revealing that a large part of the stolen assets is now traceable. In an executive summary posted on X on April 21, Zhou stated that out of the $1.4 billion stolen—roughly 500,000 ETH—around 27.59% has gone dark. Approximately 68.57% of the stolen assets remain traceable, and 3.84% are currently frozen.

Zhou said the missing funds moved through mixers, bridges, and eventually P2P and OTC channels. These methods made it difficult for investigators to follow the flow of the stolen assets.

4.21.25 Executive Summary on Hacked Funds:
Total hacked funds of USD 1.4bn around 500k ETH. 68.57% remain traceable, 27.59% have gone dark, 3.84% have been frozen. The untraceable funds primarily flowed into mixers then through bridges to P2P and OTC platforms.
Recently, we have…

— Ben Zhou (@benbybit) April 21, 2025

Bybit Hit by $1.4B Hack, Funds Moved Across Various Crypto Channels

Back in February, Lazarus-linked hackers breached Bybit’s cold wallet, taking $1.4 billion. This incident stands as the biggest crypto exchange hack recorded so far. Zhou mentioned that Wasabi is the main mixer used by North Korea.

Zhou said:

“Then, multiple cross-chain and swap services were carried out through platforms such as Thorchain, eXch, Lombard, LiFi, Stargate and SunSwap. Eventually, it entered OTC or P2P fiat currency exchange services.”.

Furthermore, he mentioned that 944 BTC, worth nearly $90 million, was funneled through the Wasabi mixer. The funds were then routed through various cross-chain and swap platforms before reaching P2P and OTC services.

Zhou revealed that hackers bridged over 432,000 ETH, valued at $1.21 billion, using THORChain. Hackers converted around $960 million in ETH into 10,003 BTC and distributed it across thousands of wallets. He also mentioned that about $17 million in Ether remains on the Ethereum blockchain, held in 12,490 wallets.

Zhou urged on-chain bounty hunters to assist in freezing the stolen funds, noting that 70 out of 5,443 reports submitted in the last 60 days were valid. Bybit has pledged to reward bounty hunters with 10% of the recovered funds and has already distributed $2.3 million to 12 successful hunters. “We welcome more reports, we need more bounty hunters that can decode mixers, as we need a lot of help there down the road,” Zhou said.

Privacy Platform eXch to Shut Down Amid Money Laundering Allegations

Meanwhile, eXch, a privacy-focused crypto platform mentioned by Zhou, announced it will shut down on May 1 due to a “transatlantic operation” over money laundering charges linked to Lazarus. Although eXch did not confirm Lazarus used its platform for mixing stolen Bybit crypto, it expressed regret. The platform said privacy projects had to compromise their values due to the industry’s pressure following Bybit’s breach.

Chainflip DEX paused its platform after reports revealed Bybit funds moved through decentralized protocols, aiming to boost security. THORChain decided against blocking users, leading to the departure of some members.