Bybit, a major cryptocurrency exchange, was hit by a massive cyberattack on February 26th, 2025, losing about $1.46 billion. Just under two weeks later, CEO Ben Zhou updated everyone on the investigation, revealing that a large portion of the stolen money is now ‘untraceable.’
Ben Zhou Provides Investigation Details
Zhou’s recent X post explained where the stolen funds went. Seventy-seven percent of the stolen Ethereum remains traceable. This is primarily because thieves initially converted the ETH to Bitcoin via THORChain, a cryptocurrency transfer system.
This conversion involved numerous transactions: They swapped 83% of the stolen funds—approximately $1 billion—into BTC and distributed it across 6,954 digital wallets. Although this helped investigators track the money, the remaining 23% is much harder to follow.
Cryptocurrency mixing services obscured nearly 20% of the untraceable funds, amounting to over $200 million. This obfuscation significantly complicates tracing and recovery. Specifically, thieves routed 72% of the stolen ETH, equating to $900 million, through THORChain before converting it to BTC.
Furthermore, they processed another 16%, approximately $160 million, through ExCH, a centralized crypto mixing service, making it largely untraceable. Zhou has indicated that Bybit is awaiting further updates from ExCH regarding these transactions.
Another segment of the stolen funds, approximately $65 million, remains untraceable due to transactions processed through OKX’s Web3 wallet. Bybit requires additional information from OKX to fully investigate and potentially trace this portion of the stolen assets.
THORChain Stays Silent
While some protocols actively cooperated in freezing and tracing stolen funds, THORChain’s response has drawn considerable criticism. On-chain analyst EmberCN, tracking the stolen Ethereum, reported on X that THORChain, a decentralized cross-chain liquidity protocol, routed a significant portion before converting it into Bitcoin.
The protocol’s validators rejected a governance proposal to halt ETH transactions, allowing the perpetrators to launder a substantial portion of the stolen assets. A core contributor, Pluto, resigned in protest over this decision, highlighting the internal conflicts and challenges in responding effectively to such attacks.
Despite the significant loss, Bybit has actively engaged in recovery efforts. Eleven parties have assisted in freezing a portion of the stolen funds, receiving a total bounty of $2,178,797 USDT. Notable contributors include Mantle, Paraswap, and the prominent blockchain investigator ZachXBT who actively provides details of the fund tracking.
Ephraim Emmanuel | July 23, 2026
Jonathan Agozie | July 22, 2026
