Bybit Hack Update: $380M in Crypto Lost in Lazarus Group Attack Has Gone Untraceable

Bybit’s CEO, Ben Zhou, confirmed Monday that nearly 28% of the $1.4 billion stolen in the February hack by the North Korean Lazarus Group is now untraceable. This includes funds that have vanished into mixers and peer-to-peer (P2P) platforms, making them difficult to follow.

In an executive summary posted on X (formerly Twitter), Zhou detailed the status of the stolen funds: “Out of the total $1.4 billion stolen — approximately 500,000 ETH — 68.57% remains traceable, 27.59% has gone dark, and 3.84% has been frozen.” Zhou went on to explain that the untraceable funds primarily passed through crypto mixers and cross-chain bridges, which helped to obscure their origin and movement.

The stolen assets were first routed through mixers like Wasabi, Railgun, Tornado Cash, and CryptoMixer, with a portion of the funds being washed into Bitcoin (BTC). From there, the hackers employed multiple cross-chain swapping protocols such as Thorchain, eXch, Lombard, LiFi, Stargate, and SunSwap. This final stage allowed the illicit funds to be converted into more liquid forms of crypto.

The attack, which was attributed to the Lazarus Group, saw the hackers gain access to a specific ETH cold wallet, draining 500,000 ETH. According to blockchain forensics, a significant portion of the stolen ETH — 432,748 ETH, or 84.45% — was converted into Bitcoin via Thorchain. Notably, 342,975 ETH (around $960 million) was swapped into 10,003 BTC, which was then spread across 35,772 wallets, with each wallet holding an average of 0.28 BTC.

Additionally, 1.17% of the funds, or about 5,991 ETH (roughly $16.77 million), still resides on the Ethereum blockchain, spread across 12,490 wallets.

In response to the hack, Bybit launched the Lazarus Bounty initiative, encouraging the public to assist in tracking down the stolen funds. So far, the program has received 5,443 reports, of which 70 have been deemed valid. Zhou emphasized the need for further support: “We need more bounty hunters who can decode mixers. We’ll need a lot of help moving forward.”

This hack serves as a stark reminder of the growing complexity of blockchain-based crime and the challenges in tracking stolen crypto across increasingly sophisticated laundering schemes.