Bitcoin

THORChain

would

The ByBit hackers successfully laundered the entire 499,000 $ETH ($1.39 billion) stolen from the Bybit cryptocurrency exchange, according to&nbsp;<a style="text-decoration:none" href="https://x.com/EmberCN/status/1896728373340303440">EmberCN</a>. Per reports, the process took just ten days, with THORChain serving as the primary channel for laundering, handling $5.9 billion in transaction volume and earning $5.5 million in fees.
Hackers reportedly used&nbsp;mixing techniques, instant swap services, and decentralized platforms without Know Your Customer (KYC) requirements to obscure the trail.
<h2 dir="ltr" id="span-span-strong-fbi-confirms-north-korean-involvement-strong-span-span">FBI Confirms North Korean Involvement</h2>
The&nbsp;Federal Bureau of Investigation (FBI) has officially linked the&nbsp;<a style="text-decoration:none" href="https://bsc.news/post/the-biggest-bybit-s-1-4-b-crypto-hack-how-it-happened-and-what-s-next">ByBit hack</a> to North Korea. In a public service announcement on&nbsp;February 26, 2025, the FBI stated that the&nbsp;TraderTraitor cyber actors were responsible for the heist, which took place on&nbsp;February 21, 2025.
The agency revealed that the attackers converted portions of the stolen ETH into&nbsp;<a style="text-decoration:none" href="https://bsc.news/post/what-is-bitcoin-how-it-works-mining-digital-gold-guide">Bitcoin</a> and other cryptocurrencies, dispersing funds across&nbsp;thousands of addresses. The FBI warned that these assets would likely be further laundered and eventually exchanged for&nbsp;fiat currency.
To counteract these efforts, the FBI has called on&nbsp;RPC node operators, crypto exchanges, blockchain analytics firms,&nbsp;<a style="text-decoration:none" href="https://bsc.news/post/decentralized-finance-defi-comprehensive-guide">DeFi</a> services, and other virtual asset providers to block transactions linked to the stolen assets. The agency has also released wallet addresses associated with the hackers.
<h2 dir="ltr" id="span-span-strong-how-the-hack-happened-strong-span-span">How the Hack Happened</h2>
Bybit confirmed that the hack occurred during a&nbsp;routine transfer of&nbsp;<a style="text-decoration:none" href="https://bsc.news/post/what-is-ethereum-eth-how-it-works-explained">Ethereum</a> from an offline “cold” wallet to a “warm” wallet used for daily trading. The attacker&nbsp;exploited security vulnerabilities during this process, gaining access to the funds and transferring them to an unknown address.
Bybit assured users that their holdings remained safe.&nbsp;CEO Ben Zhou stated that the company is solvent and&nbsp;all client assets are fully backed. Zhou emphasized that Bybit would&nbsp;cover any unrecovered losses, thanks to its&nbsp;$20 billion in customer assets and potential loans from partners.
The hacker reportedly used a complex laundering strategy, utilizing:
<ul>
 <li>Intermediary wallets</li>
 <li>Decentralized exchanges (DEXs)</li>
 <li>Cross-chain bridges</li>
</ul>
Among these,&nbsp;THORChain played a major role. This led to controversy within the&nbsp;THORChain community, with one core developer&nbsp;<a style="text-decoration:none" href="https://x.com/Pluto9r/status/1895150363298406808">resigning</a> over concerns about the platform’s involvement in the laundering process.
<h2 dir="ltr" id="span-span-strong-efforts-to-recover-the-stolen-funds-strong-span-span">Efforts to Recover the Stolen Funds</h2>
Bybit is actively seeking to recover the stolen ETH. The company has called on&nbsp;cybersecurity experts and blockchain analysts to assist in the effort and is offering a&nbsp;10% bounty on any recovered funds, potentially worth&nbsp;$140 million.
This attack adds to growing concerns about&nbsp;North Korean cyber operations targeting the crypto sector. The FBI and blockchain intelligence firms like&nbsp;Elliptic and TRM Labs have flagged over&nbsp;11,000 wallet addresses linked to the hack, confirming the&nbsp;attackers’ operational efficiency.

How Did Bybit Hackers Launder $1.39B in 10 Days?

Table of Contents

BSCN

Other articles published on Mar 6, 2025

Ripple’s Bold Move: How XRP is Disrupting Cross-Border Payments in Portugal and Brazil

This $7 Billion In XRP Linked to Ripple Chairman Chris Larsen Sparks Discussion

NEOPIN Annual Update: 2024

RENDER and NEAR Approaches Falling Wedge Resistance – Could Breakout Spark a Rally?

Bitcoin (BTC) Share from White House Advisor David Sacks Before the Critical Summit!

BlackRock's Bitcoin Holdings Grow as Market Bounces Back

Join our free newsletter for daily crypto updates!