TRON and Tether, Through T3FCU, Freeze $9 Million in Stolen Bybit Funds – Can They Track Down the Rest of the Stolen $1.5 Billion?

Crypto Crime Unit Freezes $9 Million Stolen in Bybit Hack

A collaborative crypto crime unit has made progress in tracking down funds stolen during the Bybit exploit, successfully freezing $9 million linked to the attack.

The stolen assets, part of a massive $1.5 billion heist attributed to North Korean hackers, were intercepted through efforts led by the T3 Financial Crime Unit (T3FCU).

Crypto Firms Join Forces to Tackle Financial Crime

T3FCU, a joint initiative launched in August 2024 by TRON, Tether, and TRM Labs, focuses on identifying and disrupting illicit financial activities within the digital asset space.

Working closely with global law enforcement agencies, the unit has helped freeze substantial sums tied to criminal operations, including $36 million linked to fraudulent investment schemes and $65 million tied to money laundering.

Blockchain analytics are increasingly crucial in crime prevention, as evidenced by recent developments in the Bybit case.

TRON confirmed the $9 million freeze on X, adding that further details would be discussed at the Digital Chamber blockchain summit on 26 March 2025.

Analysts Play Key Role in Blockchain Forensics

The investigation was aided by independent blockchain analysts, including ZachXBT and ZeroShadow, whose expertise helped track the stolen assets.

Bybit CEO Ben Zhou had previously acknowledged ZeroShadow’s contributions, emphasising the importance of external forensic specialists in recovering stolen funds.

Tracking stolen crypto presents unique challenges, as attackers employ advanced laundering techniques to obscure transactions.

TRM Labs reported that $2.2 billion was stolen in crypto hacks and exploits in 2024, marking a 17% increase from the previous year.

The surge of crypto hacks and exploits in 2024 has resulted in over $7.7 billion stolen in the past three years, with DeFi platforms remaining primary targets. (Source: TRM Labs)

The report also revealed that North Korean hackers were responsible for 35% of all stolen funds, looting an estimated $800 million throughout the year.

Bybit Hackers Launder Funds Through Mixers and Exchanges

The Bybit exploit, which took place on 21 February 2025, resulted in the loss of over $1.4 billion in digital assets, mostly in Ethereum (ETH).

The attack was quickly attributed to the Lazarus Group, a state-sponsored North Korean hacking syndicate known for high-profile cybercrimes.

Investigators discovered that the hackers exploited a vulnerability in Bybit’s cold wallet system during a routine transfer.

By injecting malicious code into the user interface, they manipulated transactions, rerouting 401,000 ETH to wallets under their control while making the transfers appear legitimate.

As seen in previous incidents, the hackers swiftly laundered the stolen crypto, using mixers and converting assets across multiple blockchains to avoid detection.

Bybit’s Response and Bounty Program

Despite the massive loss, Bybit assured customers that the platform remains solvent, with over $20 billion in assets under management.

The exchange has been actively working with blockchain investigators and law enforcement agencies to track and recover the stolen funds.

To incentivise further investigations, Bybit launched a bounty program named "Lazarus Bounty," offering a reward of up to $140 million—10% of the stolen amount—for valuable information leading to asset recovery.

However, as of 20 March 2025, out of the 5,012 bounty submissions received, only 63 were deemed valid.

With the recent success in freezing $9 million, recovery efforts continue as investigators work to trace and reclaim the remaining stolen assets.