Over $380M in Crypto From Bybit’s $1.4B Hack Has Gone Dark, CEO Confirms
Roughly 28% of the $1.4 billion in crypto stolen during the February Bybit hack has become untraceable, according to a new update from the exchange’s CEO, Ben Zhou. The attack, attributed to North Korea’s state-sponsored Lazarus Group, remains one of the largest in the industry’s history.
In an executive summary shared on X (formerly Twitter) Monday, Zhou said that 27.59% of the stolen funds — around $386 million — have effectively “gone dark,” while 68.57% remain traceable and 3.84% have been frozen.
“The untraceable funds primarily flowed into mixers then through bridges to P2P and OTC platforms,” Zhou wrote, referring to tools used to obscure blockchain activity and launder stolen assets.
The laundering process involved several well-known crypto mixers, including Wasabi, Railgun, Tornado Cash, and CryptoMixer. Bitcoin obtained through these services was later moved across chains using protocols such as Thorchain, eXch, Lombard, LiFi, Stargate, and SunSwap, ultimately converting the assets into more liquid cryptocurrencies.
The February breach saw hackers gain access to a specific ETH cold wallet, resulting in the theft of approximately 500,000 ETH. Blockchain forensics show that 432,748 ETH — or 84.45% of the total haul — was later converted to bitcoin using Thorchain.
Of that, 342,975 ETH (around $960 million) was swapped for 10,003 BTC and dispersed across 35,772 unique wallets, averaging just 0.28 BTC per address — a clear obfuscation tactic. An additional 5,991 ETH (about $16.8 million), or 1.17% of the funds, still resides on the Ethereum blockchain, distributed among 12,490 wallets.
In response to the attack, Bybit launched the Lazarus Bounty initiative to crowdsource intelligence on the stolen funds. Zhou revealed that over 5,400 bounty reports have been submitted in the past two months, with 70 verified as actionable leads. Still, he emphasized the need for more expertise: “We need more bounty hunters who can decode mixers — we’ll need a lot of help going forward,” he said.
