Bybit Hack Funds Laundered: Lazarus Group Swiftly Cleans $1.39B

A recent hack on the Bybit cryptocurrency exchange has resulted in the theft of approximately $1.4 billion worth of Ethereum (ETH). The perpetrators, believed to be the North Korean-linked Lazarus Group, managed to launder nearly all the stolen funds within just 10 days, leveraging THORChain as their primary tool.

Breakdown of the Laundered Funds

According to an executive summary released on April 3, 2025:

• $1 billion (83% of stolen ETH) was converted into Bitcoin across 6,954 wallets.
• THORChain was used to process 72% of transactions, making it the primary method of laundering.
• $900 million (361,255 ETH) remains traceable, while 16% of the funds ($180 million) have gone dark via ExCH.
• OKX Web3 Proxy was used to process $100 million (40,233 ETH), of which $65 million remains untraceable pending further investigation from OKX.

Fund Freezing Efforts and Bounties

Despite the rapid laundering, authorities and exchanges have successfully frozen 3% of the stolen assets. The next two weeks are expected to be critical as investigators attempt to track and seize the remaining funds before they are fully dispersed across OTC and P2P markets.

Bounty programs have played a crucial role in identifying the hackers’ movements. So far, 11 entities, including Mantle, Paraswap, and blockchain investigator ZachXBT, have helped freeze stolen assets. A total of $2,178,797 USDT has been paid out to bounty hunters who contributed to tracking efforts.

For more details, the latest updates are available at Lazarusbounty.com.

Community Reaction

The crypto community is buzzing, and opinions are flying in all directions:

• @Promirexy pointed out that “77% of the hacked funds are still traceable, with most ETH swapped for BTC via THORChain.” They gave a shoutout to Mantle, Paraswap, and ZachXBT for their efforts in tracking the stolen assets.
• @BrokeLambo called out platforms for staying silent, saying, “It’s funny how you tagged all these platforms, and there is 0 mention on their socials about all of this. Their own bottom line aka fees seem more important than helping to recover funds.”
• @ImNotTheWolf kept it blunt and not very rational: “Short $THOR.”

What This Means for You

This event highlights the increasing sophistication of crypto hacks and the challenges in recovering stolen funds. If you’re holding assets on centralized exchanges, ensuring strong security measures, including two-factor authentication (2FA) and withdrawal whitelisting, is crucial. Additionally, regulators and exchanges may tighten monitoring around platforms like THORChain, affecting privacy-focused transactions in the near future.