Bybit CEO: $1 Billion in Stolen Crypto Still Traceable, Hackers Moving Funds Through THORChain

More than 77% of the crypto stolen in Bybit’s record-breaking hack remains traceable on-chain, while around 20% has been successfully laundered and is now untraceable, Bybit CEO Ben Zhou revealed in an update on X early Tuesday.

“The coming days will be crucial for tracking and freezing these funds before they are fully cashed out through exchanges, OTC markets, and P2P networks,” Zhou warned, underscoring the importance of immediate action.

Currently, 417,348 ether (ETH), valued at approximately $1 billion, remains visible on the blockchain, despite hackers attempting to obscure transactions through privacy-focused THORChain. Meanwhile, about 79,655 ETH (~$200 million) has been fully laundered using ExCH, making further tracking nearly impossible.

Another 40,233 ETH ($100 million) flowed through OKX’s Web3 proxy, with 23,553 ETH ($65 million) now completely off the radar.

Zhou also noted that hackers converted 83% of the stolen ETH—roughly 361,255 ETH (~$900 million)—into Bitcoin, dispersing the funds across 6,954 wallets, each holding an average of 1.71 BTC.

Data from DefiLlama shows that THORChain saw a record-breaking $4.66 billion in swap volume in the week ending March 2, generating over $5.5 million in transaction fees, much of which is suspected to be linked to the Bybit exploit.

The attack, attributed to North Korea’s notorious Lazarus Group, was executed by injecting malicious code into SafeWallet, a third-party wallet used by Bybit. Hackers reportedly compromised a developer’s device, enabling them to manipulate a routine transaction and siphon off nearly $1.5 billion in ETH.

Despite the staggering loss, Bybit swiftly restored a full 1:1 backing of customer assets. Blockchain data indicates that over $400 million was replenished via OTC trades, while an additional $300 million was sourced directly from exchanges to ensure platform solvency.