North Korea’s Lazarus Group allegedly stole $1.4 billion in Ethereum from Bybit, the largest crypto exchange hack ever. The exchange’s CEO, Ben Zhou, said in a latest update that $386 million of the loot remains untraceable, having been laundered through mixers and P2P platforms, leaving investigators racing to recover the funds.
$386M Bybit Loot Remains Aloof
On February 21, 2025, hackers linked to North Korea’s Lazarus Group exploited Bybit’s Ethereum cold wallet, stealing 500,000 ETH, worth $1.4 billion. The attackers compromised a Safe Wallet developer system, inserting malicious code to siphon funds to an unidentified address. According to Zhou’s latest X post, 68.57% ($960 million) of the stolen funds remain traceable, 27.59% ($386 million) have “gone dark,” and 3.84% ($54 million) are frozen.
The untraceable funds were laundered through mixers like Wasabi, CryptoMixer, Tornado Cash, and Railgun, then moved via cross-chain platforms such as Thorchain, eXch, Lombard, LiFi, Stargate, and SunSwap. Ultimately, funds reached P2P and OTC fiat exchange services, making tracking difficult. Of the looted Ethereum, 84.45% (432,748 ETH worth approximately $1.21 billion) was converted to Bitcoin via Thorchain. Currently, 67.25% (342,975 ETH worth $960 million) is held in 10,003 BTC across 35,772 wallets. About 1.17% (5,991 ETH worth $16.77 million) remains on Ethereum in 12,490 wallets.
Additionally, 944 BTC ($90.62 million) passed through Wasabi, and 531 BTC ($18,206 ETH) was converted back to Ethereum.
A Fallout of the Hack
In the meantime, while over two-thirds of the $1.4 billion Bybit loot remains traceable despite hackers using an array of mixing services to cover their tracks, the case has taken a somewhat surprising twist as crypto exchange eXch has announced that it will cease operations on May 1, 2025, following allegations of laundering $35 million tied to the $1.4 billion Bybit hack. The platform admitted to processing a small portion of the stolen funds, sparking global concern.
Zhou calls for more experts to decode mixers, as laundering tactics grow sophisticated. Bybit remains solvent, backed by $20 billion in assets, and continues to process withdrawals as usual. It urges the crypto community to unite against such cyberattacks.
