Bybit CEO Reveals Nearly 30% of $1.4B Hack Funds Has ‘Gone Dark’ After Mixer Use

2025/04/21 16:58

关注

Bybit Hack Fallout Grows As Over $1.4B In Crypto Still Being Tracked

Nearly two months after a record-breaking $1.4 billion crypto hack hit Bybit, a large portion of the stolen assets remains traceable—despite complex laundering attempts involving mixers, cross-chain bridges, and decentralised exchanges.

On 21 April 2025, Bybit CEO Ben Zhou shared an update on X about the stolen assets' whereabouts, noting that while most remain trackable, a significant portion has already “gone dark.”

4.21.25 Executive Summary on Hacked Funds:
Total hacked funds of USD 1.4bn around 500k ETH. 68.57% remain traceable, 27.59% have gone dark, 3.84% have been frozen. The untraceable funds primarily flowed into mixers then through bridges to P2P and OTC platforms.
Recently, we have…
— Ben Zhou (@benbybit) April 21, 2025

How The Stolen ETH Was Washed Across Chains

Zhou confirmed that around 500,000 ETH were siphoned from the platform following a targeted malware attack believed to have been carried out by North Korea’s Lazarus Group.

The attackers allegedly compromised a Safe{Wallet} developer system and inserted malicious code into the Bybit signers’ interface, redirecting funds in what appeared to be valid transactions.

Of the 500,000 ETH, 432,748 ETH—roughly $1.21 billion or 84.45%—was moved through the cross-chain liquidity protocol Thorchain and converted into 10,003 BTC.

The BTC was then dispersed across 35,772 wallets, each holding just 0.28 BTC on average, a method designed to fragment and obscure the trail.

Nearly 30 Percent Of Stolen Crypto Now Untraceable

In his X post, Zhou reported that 68.57% of the stolen funds remain traceable.

However, 27.59%—around $386 million—has effectively “gone dark” after being funneled through privacy-focused tools.

Only 3.84% of the stolen crypto has been successfully frozen.

The laundering chain began with Wasabi Mixer, which Zhou said is now the “primary tool used by DPRK-linked groups.”

Bybit Updated: Total hacked funds of USD 1.4bn around 500k ETH. 68.57% remain traceable, 27.59% have gone dark, 3.84% have been frozen. Recently, we have observed that the mixer mainly used by the DPRK is Wasabi. After a certain amount of BTC was washed through Wasabi, a small…
— Wu Blockchain (@WuBlockchain) April 21, 2025

After Wasabi, the funds were further layered through platforms like CryptoMixer, Tornado Cash, and Railgun, before being bridged or swapped across Thorchain, eXch, LiFi, Stargate, Lombard, and SunSwap.

Eventually, the assets were off-ramped to fiat via over-the-counter and peer-to-peer exchanges, further complicating recovery efforts.

Was The Bounty Hunt A True Public Effort?

Bybit launched a bounty programme to trace the stolen funds, offering 10% of any recovered amount.

In the past 60 days, 5,443 reports have been submitted, but only 70 were confirmed as valid.

This unusually low success rate has raised eyebrows within the crypto community.

A X user, Kevin Ang, responded to Zhou’s post by pointing out,

“Transparency appreciated, Ben. But I’ve got one question:

Out of 5,443 bounty reports, only 70 were valid? That level of precision doesn’t sound like crowdsourced discovery—it sounds like insiders already knew what to look for. Were those 70 bounty hunters public contributors, or were they white-hats already close to the fire? Because to outsiders, this feels less like a hunt and more like a post-exploit sanitisation operation.”

Transparency appreciated , Ben. But I’ve got one question:

Out of 5,443 bounty reports, only 70 were valid ?

That level of precision doesn’t sound like crowdsourced discovery.
It sounds like insiders already knew what to look for.

Were those 70 bounty hunters public…
— Kevin Ang (@fstorm28) April 21, 2025

Others voiced similar concerns, with another user commenting,

“It’s very odd that we identify no one after stealing this much. We need to crack down and press legal charges; otherwise, it’s become quite normal.”

Thanks for the update Ben. Any legal update on the traceable funds ?

It’s very odd that we identify no one after stealing this much. We need to crackdown and press legal charges otherwise it’s become quite normal.

This is the whole reason why government skeptic about bringing…
— Crypto 🔶 ₿N (@Crypto_bn) April 21, 2025

eXch Confirms Shutdown Amid Legal Heat

Among the platforms identified in the laundering process, eXch—a privacy-first crypto exchange—confirmed it will shut down operations by 1 May 2025.

In its announcement, the team attributed the closure to pressure from an international investigation and denied knowingly assisting in illicit transfers.

The eXch team stated,

“We had to compromise our privacy ideals under the immense pressure that the whole industry had to deal with due to the irresponsible actions of those at ByBit.”

🚨eXch is shutting down🚨@exchcx has announced it will shut down on May 1st, 2025. The project became the target of a transatlantic law enforcement operation over alleged "money laundering and terrorism" charges. To avoid further risks and protect both the team and the… https://t.co/RpMQUiwEWx pic.twitter.com/7v8RnJLpyi
— MistTrack🕵️ (@MistTrack_io) April 18, 2025

Lazarus Activity Prompts Tech Response

Following public concern over the misuse of decentralised protocols, Chainflip DEX temporarily paused operations to roll out security updates aimed at preventing its misuse in laundering activities.

Meanwhile, despite internal discussions, THORChain opted not to implement restrictions, which led to the departure of several of its members.

Zhou, addressing the ongoing situation, stressed the importance of community efforts,

“We welcome more reports. We need more bounty hunters who can decode mixer activity—we need a lot of help down the road.”

Only 1.17% of the original ETH remains on Ethereum, scattered across 12,490 wallets.

With most of the stolen funds either converted or hidden across various decentralised layers, the case remains one of the most sophisticated digital heists in crypto history.

Bybit

了解更多行业报道，与作者、读者更深入探讨、交流，欢迎加入Coinlive社群：https://t.me/CoinliveSG

添加评论

登录留下您的精彩评论……

0 评论

最早的

加载更多评论

Bybit CEO Reveals Nearly 30% of $1.4B Hack Funds Has ‘Gone Dark’ After Mixer Use

Bybit Hack Fallout Grows As Over $1.4B In Crypto Still Being Tracked

How The Stolen ETH Was Washed Across Chains

Nearly 30 Percent Of Stolen Crypto Now Untraceable

Was The Bounty Hunt A True Public Effort?

eXch Confirms Shutdown Amid Legal Heat

Lazarus Activity Prompts Tech Response

相关资讯

特朗普当选或将引爆比特币市场，赔率与预测平台暗示胜算更高

朝韩局势紧张:比特币或成避险资产?

中国矿池大佬“神鱼”证实12083枚以太坊被盗！价值2亿元人民币

价值20亿美元的ETH从与plustoken相关的钱包转移，疑似案件主要罪犯出狱所导致

特朗普在纳什维尔比特币大会发表比特币主题演讲，承诺将美国打造成世界加密之都

OKX在telegram上推出比特币博彩游戏OKX Racer，下一步或将使用其原生代币OKB,OKT进行真实押注

特朗普遇刺让比特币价格重回6万美元，加密市场进入春天

随着现货 ETH ETF 上市的脚步越来越近，以太坊反弹即将到来，Whale 转移了价值 5000 万美元的以太坊

富爸爸穷爸爸作者罗伯特清崎：是时候购买更多比特币和黄金了

苏里南总统候选人玛雅·帕尔博（Maya Parbhoe）将推广比特币为法定货币，使苏里南成为世界上第三个认定比特币为法定货币的国家

实时更新

热门资讯

Agoda Celebrates Cultural Diversity with its Latest AI-Driven Travel Adventure

China’s New Crime-Fighting Robot Could Soon Be Patrolling Your Streets

El Salvador and Argentina Collaborate to Drive Crypto Innovation Across Latin America – Will this partnership reshape the region's digital future?

OpenAI Brings Canvas Editing Power to All ChatGPT Users for Writing and Coding

Ripple's RLUSD Stablecoin Gets Approval from New York Regulator as XRP Price Surge

Is Google Losing Its Grip as AI-Powered Search Tools Rise?

Meme Coin Backer to Launch Japan's First Crypto Credit Card Next Year: Will 2025 Be the Year Crypto Goes Mainstream?

Telegram Malware Scam Preys on Crypto Users via Fake Influencer Profiles: Are Crypto Scams Evolving Too Fast for Us to Counteract?

Autistic Teen's Mother Sues Character.AI After Chatbot Told Her Son It Was Okay to Kill His Parents

Google Debuts Gemini 2.0, Its Most Versatile AI Model Yet But is it Really a Model for “Everything”?