Bybit CEO Ben Zhou revealed that a significant portion of the $1.4 billion stolen from the exchange during a February 2025 hack—linked to North Korea’s Lazarus Group—remains traceable, despite attempts to obfuscate the funds.
In an update shared on X on April 21, Zhou stated that 68.6% of the stolen assets are still traceable, while 27.6% have “gone dark” and only 3.8% has been successfully frozen.
Largest Crypto Hack in History: How the Funds Moved
The hack, which targeted Bybit’s cold wallet infrastructure, is now considered the largest exchange breach to date. According to Zhou, hackers moved stolen funds through a series of advanced laundering techniques, starting with Wasabi Wallet, a privacy-focused Bitcoin mixer heavily used by Lazarus operatives.
“944 BTC (~$90 million) was washed through Wasabi,” Zhou confirmed.
Afterward, smaller amounts were funneled through CryptoMixer, Tornado Cash, and Railgun. From there, the funds were bridged and swapped across multiple ecosystems, including:
- THORChain
- eXch
- Lombard
- LI.FI
- Stargate
- SunSwap
Eventually, the assets landed in peer-to-peer (P2P) and over-the-counter (OTC) trading networks, making further tracking increasingly difficult.
4.21.25 Executive Summary on Hacked Funds:
Total hacked funds of USD 1.4bn around 500k ETH. 68.57% remain traceable, 27.59% have gone dark, 3.84% have been frozen. The untraceable funds primarily flowed into mixers then through bridges to P2P and OTC platforms.
Recently, we have…— Ben Zhou (@benbybit) April 21, 2025
Ethereum Funds Converted to BTC Across Thousands of Wallets
A majority of the stolen Ether—432,748 ETH, worth $1.21 billion—was swapped into Bitcoin using THORChain, Zhou revealed. Of that, around $960 million in ETH was converted into 10,003 BTC, distributed across 35,772 wallets.
Only $17 million worth of Ether remains on the Ethereum blockchain, spread across 12,490 wallets.
Despite the scale of the operation, Zhou emphasized that Bybit continues working with blockchain analytics firms and law enforcement agencies to recover funds and track down the attackers.
Kosta Gushterov
Reporter at Coindoo
Kosta has been a part of the team since 2021 and has solidified his position with a thirst for knowledge, incredible dedication to his work and a “detective-like” mindset. He not only covers a wide range of trending topics, he also creates reviews, PR articles and educational content. His work has also been referenced by other news outlets.
Source: https://coindoo.com/bybit-ceo-says-960m-in-stolen-crypto-still-traceable-after-lazarus-hack/