Bybit Reports Majority Of $1.4B In Stolen Funds Remain Traceable, With 3.84% Frozen
In Brief
Ben Zhou revealed that $1.4 billion in stolen cryptocurrency has been identified, with 68.57% still traceable, while 27.59% has been laundered through crypto mixers and routed through P2P and OTC exchanges.
CEO of the cryptocurrency exchange Bybit, Ben Zhou shared an executive summary outlining the current landscape of stolen cryptocurrency funds, shedding light on both the scale and movement of these assets.
According to the report, a total of approximately USD 1.4 billion—equivalent to around 500,000 ETH—has been identified as hacked funds. Of this amount, roughly 68.57% remains traceable, while 27.59% has become untraceable, and 3.84% has been successfully frozen. The portion of funds that can no longer be tracked has largely been funneled through cryptocurrency mixers, followed by cross-chain bridges, and eventually moved into peer-to-peer (P2P) and over-the-counter (OTC) trading platforms.
Ben Zhou pointed out that recent monitoring by Bybit has indicated Wasabi as the primary cryptocurrency mixer being utilized by actors associated with the Democratic People’s Republic of Korea (DPRK). After being processed through Wasabi, some of the funds were later routed through additional privacy-focused tools such as CryptoMixer, Tornado Cash, and Railgun.
These funds were then subjected to a variety of cross-chain swaps and conversion services through decentralized platforms including Thorchain, eXch, Lombard, LiFi, Stargate, and SunSwap. Ultimately, they were funneled into OTC or P2P exchanges where they could be converted into fiat currencies, making further tracking increasingly difficult.
Ben Zhou Details Movement Of $1.2B In Stolen Ethereum, Highlights Bounty Efforts With 5,443 Reports Submitted
Ben Zhou also provided a detailed breakdown of the current status of the stolen Ethereum, emphasizing the movement and conversion of the majority of the funds. He noted that approximately 432,748 ETH—representing around 84.45% of the stolen assets, valued at roughly $1.21 billion—has been transferred from the Ethereum blockchain to Bitcoin using the Thorchain protocol. Out of this amount, about 67.25%, or 342,975 ETH (estimated at $960.33 million), has already been converted into 10,003 BTC, now distributed across 35,772 individual wallets, with an average of approximately 0.28 BTC per wallet.
In contrast, a relatively small portion of the stolen ETH—approximately 5,991 ETH, or 1.17% of the total, valued at around $16.77 million—remains on the Ethereum blockchain. These remaining tokens are held in 12,490 wallets, each containing an average of 0.48 ETH.
Regarding the converted Bitcoin, Ben Zhou reported that around 944 BTC, or 6.34% of the total (roughly $90.62 million), was routed through the Wasabi Mixer, a privacy tool known for obfuscating transaction trails. Meanwhile, 531 BTC, equivalent to approximately 18,206 ETH or 3.57% of the stolen amount, has since been transferred back to Ethereum via Thorchain.
In the wake of the security incident, Bybit has received over 5,443 bounty reports from the community, of which 70 have been verified as valid submissions. Ben Zhou reiterated the platform’s ongoing efforts to encourage more contributions from security researchers and bounty hunters to assist in tracing stolen funds and strengthening platform resilience.
The breach, which occurred on February 21st, marked the largest security incident ever reported by a centralized exchange. The attack has been attributed to a sophisticated malware exploit, allegedly carried out by the Lazarus Group, a cybercriminal organization linked to DPRK. The intrusion resulted in the theft of more than $1.5 billion worth of Ethereum.
Disclaimer
In line with the Trust Project guidelines, please note that the information provided on this page is not intended to be and should not be interpreted as legal, tax, investment, financial, or any other form of advice. It is important to only invest what you can afford to lose and to seek independent financial advice if you have any doubts. For further information, we suggest referring to the terms and conditions as well as the help and support pages provided by the issuer or advertiser. MetaversePost is committed to accurate, unbiased reporting, but market conditions are subject to change without notice.
About The Author
Alisa, a dedicated journalist at the MPost, specializes in cryptocurrency, zero-knowledge proofs, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
More articles
Alisa, a dedicated journalist at the MPost, specializes in cryptocurrency, zero-knowledge proofs, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
