Reported by The BlockL Bybit CEO Ben Zhou said 27.59% of the $1.4 billion stolen from Bybit has “gone dark.”
Untraceable funds flowed into mixers then through bridges to peer-to-peer and over-the-counter platforms, Zhou said.
About 27.59% of the $1.4 billion worth of crypto stolen from Bybit exchange has "gone dark," CEO Ben Zhou said in his latest post on social media platform X.
The portion of funds that disappeared from Bybit's radar has increased since Zhou's March 4 update, when he said 77% of the funds remained traceable. In the latest summary, Zhou said that 68.57% of the stolen crypto is still traceable, while only 3.84% has been frozen.
"The untraceable funds primarily flowed into mixers then through bridges to P2P (peer-to-peer) and OTC (over-the-counter) platforms," Zhou wrote.
On Feb. 21, Bybit suffered the largest-ever hack on a centralized crypto exchange, attributed to a targeted malware attack by North Korea-backed hacker organization Lazarus Group. As a result, the exchange lost around 400,000 ETH and about 113,000 ETH-related tokens.
In the Monday update, the Bybit CEO said the hackers were mainly using bitcoin mixer Wasabi to launder stolen tokens into BTC, after which they were scattered to enter platforms CryptoMixer, Tornado Cash and Railgun.
"Then, multiple cross-chain and swap services were carried out through platforms such as Thorchain, eXch, Lombard, LiFi, Stargate and SunSwap," Zhou said. "Eventually, it entered OTC or P2P fiat currency exchange services."
About $960.3 million worth of ETH has been scattered across 35,772 wallets after being converted into 10,003 BTC, while 1.17% of the funds remain on the Ethereum network across 12,490 wallets, according to Zhou.
Zhou also encouraged onchain bounty hunters to help freeze stolen funds, saying that 70 out of 5,443 bounty reports in the past 60 days were found valid. According to the page, Bybit says it will reward bounty hunters with 10% of recovered funds and has already awarded $2.3 million to 12 hunters.
eXch shutdown Meanwhile, eXch, a privacy-focused crypto trading platform that was mentioned in Zhou's post, recently announced that it will cease operations as of May 1, due to a "transatlantic operation" to prosecute the project for money laundering charges linked to Lazarus.
Although eXch did not acknowledge Lazarus' use of the platform to mix stolen crypto from Bybit, it lamented that projects had to compromise their privacy ideals "under the immense pressure that the whole industry had to deal with due to the irresponsible actions of those at ByBit."
After reports of Bybit funds being funneled through decentralized protocols, Chainflip DEX temporarily halted its platform to deploy an upgrade that prevents hackers from using the platform.
THORChain, a cross-chain liquidity protocol that was mainly utilized by Lazarus, decided not to place such measures to block out some users despite internal discussions, which resulted in the departure of some of its members.

Bybit CEO says nearly 28% of $1.4 billion hacked crypto 'gone dark,' moved to P2P and OTC

TokenInsight

Other articles published on Apr 21, 2025

Join our free newsletter for daily crypto updates!