- Bybit tracked over 68% of the stolen crypto from the February hack linked to Lazarus Group.
- Hackers used mixers and DeFi tools to move $1.4 billion in stolen assets across networks.
- Bybit paid $2.3 million to bounty hunters who helped trace and freeze stolen crypto funds.
Bybit CEO Ben Zhou confirmed that most of the assets stolen in February’s hack remain traceable. Hackers linked to North Korea’s Lazarus Group stole $1.4 billion, including nearly 500,000 ETH. Bybit now reports that 68.57% of the stolen assets are traceable.
Approximately 3.84% of the stolen funds have been frozen. Only 27.59% of the assets have gone dark, making them difficult to follow. Investigators say the attackers used mixers, cross-chain bridges, and peer-to-peer channels to hide their activity.
Hackers Used Multiple Decentralized Tools
Hackers bridged more than 432,000 ETH, worth $1.21 billion, using THORChain. They also used Wasabi, a well-known crypto mixer, to obfuscate 944 BTC, valued at nearly $90 million. These funds later moved through various cross-chain and swapping platforms.
Decentralized services such as eXch, Lombard, LiFi, Stargate, and SunSwap also played roles in moving stolen crypto. Hackers converted around $960 million worth of ETH into 10,003 BTC. This BTC was then spread across thousands of wallets to avoid detection.
Funds Flowed Into OTC and P2P Markets
After conversion, most of the funds entered peer-to-peer or over-the-counter crypto markets. These markets lack strict regulatory oversight. That made it harder for investigators to trace the money trail.
An estimated $17 million in ETH remains on the Ethereum blockchain. This amount sits in over 12,000 wallets. Security analysts continue to monitor these wallets for movement.
Bounty Program Helps Recover Stolen Assets
Bybit has encouraged on-chain bounty hunters to assist in tracing and freezing stolen funds. So far, 70 out of 5,443 submitted reports have proven valid. The platform has paid $2.3 million in rewards to 12 bounty hunters.
Bybit offered 10% of recovered funds as rewards. The platform continues to seek more experts to trace activity through mixers and swap tools. It hopes to increase the pressure on those helping to hide the stolen crypto.
Regulatory Pressure Forces Platform Shutdowns
Crypto platform eXch, named in the laundering process, announced it will shut down on May 1. Authorities launched a joint investigation into the platform’s role in money laundering. eXch denied direct links to Lazarus but cited regulatory pressure for its closure.
Chainflip, a decentralized exchange, also paused operations. It did so after its platform was linked to the movement of stolen Bybit funds. In contrast, THORChain refused to block users. That decision led to internal fallout and team member departures.
