Bybit’s CEO, Ben Zhou, disclosed that approximately 28% of the $1.4 billion taken during the February 2025 cyberattack attributed to North Korea’s Lazarus Group is now untraceable. In a summary shared on X on April 21, Zhou explained the tactics used to obscure over $390 million worth of cryptocurrency through a network of mixers, cross-chain bridges, and OTC platforms.

Zhou stated that out of the total 500,000 ETH that was stolen, roughly 68.57% remains traceable. In contrast, nearly 27.95% has become ‘dark’ and only 3.84% has been frozen.

Lazarus Laundered Funds Through Mixers

The laundered assets initially passed through privacy-enhancing mixers like Wasabi and later transitioned through other platforms such as Tornado Cash and Railgun.

Following that, attackers utilized cross-chain bridges and platforms including Thorchain, eXch, and others to convert the stolen assets into more liquid forms.

The hack resulted in the complete control of an ETH cold wallet, draining all 500,000 ETH to an undisclosed address. Analysis revealed that approximately 432,748 ETH—around 84.45% of what was stolen—was swapped from Ether to Bitcoin using Thorchain.

Of the total, 342,975 ETH (approximately $960 million) was converted into 10,003 BTC and diffused across more than 35,700 wallets, each averaging about 0.28 BTC. Zhou also mentioned that a smaller fraction, 1.17% of the stolen assets or 5,991 ETH, is still on the Ethereum network across 12,490 wallets.

“4.21.25 Executive Summary on Hacked Funds: Total hacked funds of USD 1.4bn around 500k ETH. 68.57% remain traceable, 27.59% have gone dark, 3.84% have been frozen…” — Ben Zhou (@benbybit) April 21, 2025

In response to this attack, Bybit initiated the Lazarus Bounty program to motivate the crypto community in tracking the lost assets. Zhou noted that the program has garnered 5,443 reports, yielding 70 validated leads and expressed the need for additional participants to unravel mixer operations as a significant complexity.

eXch Ceases Operations

Recently, the cryptocurrency exchange eXch announced it would halt operations on May 1, 2025, following accusations of being a conduit for laundering funds related to the Bybit hack. The exchange cited pressure from regulatory bodies and a consensus among its leadership to exit the market.

The situation revolves around claims that North Korea’s Lazarus Group laundered around $35 million via eXch, which were part of the overall $1.4 billion stolen from Bybit earlier in the year. eXch emphasized that it had come under an “active transatlantic operation” aimed at dismantling its infrastructure and possibly prosecuting its management.

The aftermath of the Bybit breach, among the most considerable in crypto history, saw upwards of $5 billion in user withdrawals following the incident.