Key Updates:
- Bybit’s CEO disclosed that 27.95% of the $1.4 billion lost during the hack by the North Korean group known as Lazarus is now untraceable.
- The stolen money was funneled through mixers and cross-chain exchanges to obscure its origin.
- Of the hacked assets, 84.45% has been converted from ether to bitcoin, with a considerable amount spread across many wallets.
Cryptocurrency exchange Bybit’s CEO Ben Zhou indicated that 27.95% of the $1.4 billion lost in a hacking incident attributed to the Lazarus Group from North Korea is currently untraceable. In a summary released on X on Monday, he stated, “Total hacked funds of USD 1.4bn around 500k ETH. 68.57% remain traceable, 27.59% have gone dark, 3.84% have been frozen. The untraceable funds primarily flowed into mixers then through bridges to P2P and OTC platforms.
The funds were processed through various mixers before being sent across bridges to both P2P (peer-to-peer) and OTC (over-the-counter) platforms, as explained in the post, which mentioned the use of Wasabi, a type of crypto mixer, to anonymize part of the bitcoin before it was diverted into other mixers like Railgun, Tornado Cash, and CryptoMixer.
Multiple cross-chain swaps were then executed using platforms such as Thorchain, eXch, Lombard, LiFi, Stargate, and SunSwap, culminating in a conversion into more liquid assets.
The Lazarus Group, linked to North Korea, executed a hack on Bybit back in February, seizing 500,000 ether (ETH) by gaining control of a specific ETH cold wallet and diverting all its contents to an unidentified address.
Forensic analysis indicates that out of the compromised funds, 432,748 ETH, accounting for 84.45%, has been swapped from ether to bitcoin through Thorchain. Remarkably, 67.25% of this amount, approximately 342,975 ETH (valued at around $960.33 million), has been exchanged for 10,003 BTC, distributed across 35,772 wallets, with each wallet holding an average of 0.28 BTC.
Additionally, 1.17% of the assets, or 5,991 ETH (roughly $16.77 million), remains within the Ethereum blockchain, distributed across 12,490 wallets.
Finally, the Lazarus Bounty initiative has recorded 5,443 bounty claims in just two months, of which 70 have been deemed valid. Zhou emphasized the need for more participants in bounty hunting to aid in decoding mixers, stating, “we need a lot of help there down the road.”
