Over $380M in Stolen Bybit Crypto Has Gone Dark: Ben Zhou

Bybit CEO Ben Zhou revealed that nearly 28% of the $1.4 billion in crypto stolen during a February exploit by the North Korea-linked Lazarus Group has become untraceable. He shared the update via an executive summary on X, outlining that only 68.57% of the funds remain traceable, while 3.84% have been frozen.

4.21.25 Executive Summary on Hacked Funds:
Total hacked funds of USD 1.4bn around 500k ETH. 68.57% remain traceable, 27.59% have gone dark, 3.84% have been frozen. The untraceable funds primarily flowed into mixers then through bridges to P2P and OTC platforms.
Recently, we have…

— Ben Zhou (@benbybit) April 21, 2025

According to Zhou, most of the untraceable funds passed through crypto mixers and cross-chain bridges before being transferred to peer-to-peer and over-the-counter platforms. He noted the use of Wasabi, a known mixing service, to obfuscate Bitcoin trails. The stolen assets were later routed through other privacy tools like Tornado Cash, Railgun, and CryptoMixer.

The $1.4B Breach

The $1.4 billion breach on February 21 marked the largest attack on a centralized crypto platform. Bybit lost about 500,000 ETH, including roughly 113,000 ETH-related tokens, after Lazarus allegedly gained access to a cold wallet and emptied its contents.

On-chain data show that 84.45% of the stolen assets, or 432,748 ETH, were converted into Bitcoin through Thorchain. Of this, 342,975 ETH—worth approximately $960 million—was exchanged for 10,003 BTC. The BTC has since been dispersed into 35,772 wallets, averaging about 0.28 BTC per wallet.

A smaller portion of the stolen funds, around 5,991 ETH (1.17%), remains on Ethereum, spread across 12,490 addresses.

Zhou Calls for More Bounty Hunters

In his summary, the CEO noted that the laundering process involved several cross-chain protocols, including the crypto exchange eXch, Stargate, Lombard, LiFi, and SunSwap. These services helped the attackers convert the stolen crypto into more liquid assets for offloading.

Meanwhile, Bybit’s Lazarus Bounty program, launched to trace the missing funds, has collected 5,443 reports in two months. However, only 70 submissions have been verified as applicable. Nonetheless, Zhou emphasized the need for more contributors capable of unraveling mixer transactions, stating: 

“We need more bounty hunters that can decode mixers as we need a lot of help there down the road.”

Get Trending Crypto News as It Happens. Follow CoinTab News on X (Twitter) Now