Bybit Hacker Laundered 100K ETH Worth $250M in Just 4 Days

Highlights:

• Bybit hacker has laundered 100K ETH tokens valued at about $250 million in four days.
• The laundered tokens represent 20% of the entire stolen 499K tokens.
• Spotonchain said that the hacker converted some stolen tokens to Bitcoin and DAI.

While efforts are ongoing to caution against the devastating impacts of the Bybit hack incident, renowned on-chain crypto transactions tracker Spotonchain recently reported that the culprit behind the attack is actively moving the stolen valuables. Reporting its findings, Spotonchain stated that the hacker had laundered 100,000 Ethereum worth approximately $250 million within four days.

The moved coins represent 20% of the 499K stolen ETH tokens, underscoring concentrated efforts at laundering. Spotonchain added that when moving the funds, the hacker splits them into smaller amounts across multiple addresses. Going further, the on-chain tracker mentioned that the malicious actor uses THORChain for cross-chain conversion into digital assets like Bitcoin (BTC), DAI, etc.

Having laundered 100K ETH, the cyber thief still has approximately 399k stolen ETH tokens. Spotonchain noted that with such an amount, the hacker still owns more Ethereum than Vitalik Buterin, one of the Ethereum blockchain co-founders, or even the Ethereum Foundation. The foundation is a non-profit organization that deals with Ethereum and other related projects.

🚨 100,000 $ETH (~$250M) has been laundered by #Bybit hacker in under 4 days!

The hacker has now washed 20% of the stolen 499K $ETH, actively splitting funds into smaller amounts across multiple addresses and using THORChain for cross-chain swaps into $BTC, $DAI, and other… https://t.co/fSi4WXyMsz pic.twitter.com/eTlmscXGFi

— Spot On Chain (@spotonchain) February 25, 2025

Hackers’ Seamless Transactions Remain a Source of Concern

While the hacking incident raised significant concerns about centralized exchange security, the new update will worsen market participants’ perception. Many observers are more worried about hackers transacting seamlessly with little or no restrictions. This trend is not peculiar to the Bybit hacker. It has always remained the usual pattern after every successful crypto heist.

If such trends persist, it will invariably encourage more participation in crypto scams. Overall, the high anonymity associated with crypto trading implies that it would continually remain a risky venture. Similarly, crypto platforms will remain scammers’ targets as there are always loopholes to exploit following detailed research and close monitoring.

Chainflip Makes Effort to Block Illicit Transactions on its Platform

Unlike other platforms that have aided the Bybit hacker in laundering most of the stolen funds, Chainflip, a cross-chain Automated Market Maker (AMM) and a multi-chain exchange, plans to introduce a feature that would prevent scammers from using its platform to move ill-gotten funds.

Chainflip conveyed the new resolution in a February 24 press release following the Bybit crypto heist, which resulted in losses worth about $1.5 billion. In its publication, the exchange emphasized the need to protect users and Liquidity Providers (LPs).

Chainflip statement read in part:

“The broad and overwhelming consensus amongst the Chainflip ecosystem is that illicit flows endanger the protocol by exposing LPs to too much risk and that we all would like to see the interests of normal users protected.”

The decentralized exchange called the new feature the 1.7.10 upgrade. This setup comes with sophisticated screening functionalities that would help broker operators, including SwapKit and the Rango DEX aggregator, to decline illicit ETH and ERC-20 transactions.

https://t.co/Z6nx0146qN

— CHAINFLIP LABS (@Chainflip) February 24, 2025

Aside from noting its new decision was fuelled by the Bybit hack incident, Chainflip added that all stakeholders in its ecosystem agreed to launch the new feature. According to them, it will help improve the exchange’s liquidity and boost the company’s pricing status amid stiff competition from other firms.

Meanwhile, discussing a possible timeline for the upgrade release, Chainflip stated that the code for the new feature is ready. It added that the feature will go live 24 to 72 hours after rigorous, satisfactory testing.