Bybit CEO Ben Zhou reports nearly 28% of stolen crypto from the $1.4 billion February hack is now untraceable, having moved through mixers, bridges, and OTC exchanges.
Background:
- On February 21, Bybit suffered a catastrophic exploit, the largest hack ever on a centralized crypto exchange, resulting in the theft of 400,000 ETH and 113,000 ETH-linked tokens.
- The attack was attributed to North Korea’s Lazarus Group, who deployed targeted malware to breach the exchange.
- In his latest update on X, Bybit CEO Ben Zhou said 27.59% of the stolen funds have now “gone dark.”
- This is a shift from Zhou’s earlier March 4 statement, when 77% of the funds were still traceable.
- As of now:
- 68.57% remains traceable
- 3.84% has been successfully frozen
- The hackers used services like Wasabi Wallet to mix ETH into BTC, which was then routed through multiple privacy-focused platforms including CryptoMixer, Tornado Cash, Railgun, Thorchain, eXch, Stargate, SunSwap, and others.
- The laundered funds were eventually pushed through peer-to-peer (P2P) and over-the-counter (OTC) services to exit the blockchain ecosystem.
- Approximately $960.3 million in ETH was swapped into 10,003 BTC, distributed across 35,772 wallets.
- Meanwhile, 1.17% of the assets still reside on Ethereum, spread across 12,490 wallets.
Why should you pay attention?
- The scale and sophistication of this hack highlight the ongoing vulnerability of centralized exchanges, even those with significant security protocols.
- The high percentage of laundered funds that remain untraceable raises alarm over the effectiveness of current blockchain tracking and regulatory measures.
- Platforms mentioned in laundering efforts such as Thorchain and eXch have come under pressure, with eXch announcing closure, Thorchain seeing member exodus and Chainflip DEX halting activity to block illicit fund movement.
- Bybit’s proactive bounty program shows growing reliance on onchain vigilantes to freeze assets, an emerging model in crypto crime-fighting.
Who said what?
- Ben Zhou posted on X:
“The untraceable funds primarily flowed into mixers then through bridges to P2P and OTC platforms.”
- He added that funds went through Wasabi Wallet, then into platforms like Railgun and Tornado Cash, followed by swaps across Thorchain, LiFi, Stargate, and others.
- On Bybit’s bounty efforts, Zhou stated:
“In the past 60 days, 5,443 bounty reports were received of which 70 were valid bounty reports. We welcome more reports, we need more bounty hunters that can decode mixers as we need a lot of help there down the road.”
- The exchange promises 10% rewards on recovered funds to encourage ongoing community involvement.
- eXch, one of the platforms used in laundering, said in a statement ahead of its May 1 shutdown:
“We don't see any point in operating in a hostile environment where we are the target of SIGINT (Signals Intelligence) simply because some people misinterpret our goals.”
- Despite facing charges linked to Lazarus, eXch did not directly acknowledge the group’s presence on the platform.
Zooming out:
- The aftermath of the Bybit hack reflects the increasing complexity of laundering crypto assets, with decentralized protocols and mixers playing major roles.
- Regulatory bodies are likely to ramp up scrutiny on privacy tools and cross-chain infrastructure used in laundering schemes.
- Some protocols, like THORChain, have resisted calls to block wallets linked to hacks, creating philosophical rifts around censorship and decentralization.
- As the cat-and-mouse game between hackers and defenders continues, the industry may see more exchanges offering bounties and working with blockchain analytics firms to track stolen assets.
