Summary
Bybit CEO announced that 27.95% of the $1.4 billion stolen in the hacking attack orchestrated by the North Korean Lazarus Group has been untraceable.
The hackers used mixers and cross-chain exchange tools to conceal the flow of funds.
84.45%of the stolen funds were converted from Ethereum to Bitcoin, most of which have been dispersed to tens of thousands of wallets.
Ben Zhou, CEO of cryptocurrency exchange Bybit, said that 27.95% of the funds in the hack launched by the North Korean-backed Lazarus Group have been "missing" or cannot be traced, totaling about $1.4 billion.
"The total amount of stolen funds is about $1.4 billion, equivalent to 500,000 ETH. Among them, 68.57% is still traceable, 27.59% is missing, and another 3.84% has been frozen," Ben wrote in an executive summary published on X Platform on Monday. He pointed out that these untraceable funds initially flowed into mixers and then moved to peer-to-peer (P2P) and over-the-counter (OTC) platforms through cross-chain bridges.

The article pointed out that these funds had been used to clean some Bitcoins through Wasabi (an encrypted currency mixing service), and then entered other currency mixers, including Railgun, Tornado Cash and CryptoMixer.
The hacker then used multiple platforms such as Thorchain, eXch, Lombard, LiFi, Stargate and SunSwap to conduct multiple cross-chain exchanges, and finally converted the stolen money into more liquid assets.
The North Korean-backed Lazarus Group attacked Bybit in February this year, gained control of one of the exchange's Ethereum cold wallets, and transferred all of the ETH in it to an unidentified wallet address.
Forensic forensics found that a total of 432,748 ETH (84.45% of the total) of the stolen funds had been converted from Ethereum to Bitcoin through Thorchain. Of these, 67.25% of the funds, or 342,975 ETH (about $960.33 million), have been converted into 10,003 BTC and dispersed to 35,772 wallets, with each wallet holding an average of about 0.28 BTC.
In addition, 1.17% of the funds, about 5,991 ETH (about 16.77 million US dollars), still remain on the Ethereum chain, distributed in 12,490 wallets.
Finally, the Lazarus bounty program received 5,443 bounty reports in two months, of which 70 were deemed valid. Ben said, "We need more bounty hunters who can decode mixers, because we still need a lot of help in this regard."