More Than a Quarter of Bybit’s Hacked Crypto Is Now Untraceable

A significant portion of the $1.4 billion in cryptocurrency stolen during Bybit hack by North Korea’s Lazarus Group has become untraceable, according to the exchange CEO Ben Zhou.

In a tweet detailing the current status of the hacked funds – approximately 500,000 ETH – the exec reported that 27.59% have gone dark, largely due to obfuscation tactics involving crypto mixers and decentralized services.

While 68.57% of the funds remain traceable, only 3.84% have been frozen.

Crypto Mixers, Swaps, and 36,000 Wallets

Zhou noted that the primary tool for laundering the stolen funds was the Wasabi Mixer, followed by additional dispersion through CryptoMixer, Tornado Cash, and Railgun. The attackers also leveraged decentralized cross-chain swap platforms such as Thorchain, eXch, Lombard, LiFi, Stargate, and SunSwap to transfer the assets across blockchains before converting them into fiat via peer-to-peer (P2P) and over-the-counter (OTC) exchanges.

Data from Zhou’s report reveals that 432,748 ETH, which is equivalent to 84.45% of the stolen assets, has been converted into Bitcoin via Thorchain. Of that, 342,975 ETH (worth approximately $960 million) became 10,003 BTC distributed across nearly 36,000 wallets, in a bid to hinder traceability.

Despite extensive monitoring, only a fraction of the stolen assets remain on the Ethereum blockchain, while 944 BTC (around $90.6 million) were funneled through Wasabi alone.

The Lazarus Bounty initiative, which was launched to tackle these exploits, has received 5,443 reports over the past two months, with only 70 validated. Zhou highlighted the need for more bounty hunters capable of unraveling mixer transactions and warned that tracing dark crypto flows will require significant collaborative effort going forward.

eXch Quits After Accusations of Aiding Lazarus Group

Among the platforms named in the laundering trail was eXch. The privacy-focused crypto exchange recently announced its plans to cease operations on May 1, following accusations of laundering $35 million linked to February’s Bybit hack. The platform denied intentional wrongdoing and refuted claims of facilitating criminal activity.

Under mounting international scrutiny and what it called a “hostile” environment, eXch cited an “active transatlantic operation” targeting its shutdown. Along with its exit announcement, eXch also said it will launch a 50 BTC fund supporting privacy-focused crypto tools.