In a staggering breach that rocked the crypto world, crypto exchange Bybit has reported significant developments following a major hack attributed to alleged North Korean hackers.
The incident, part of a record-breaking $1.5 billion crypto heist, has seen hackers convert at least $300 million into unrecoverable funds. CEO Ben Zhou provided a detailed update on the situation through a post on social media platform X (formerly Twitter).
Bybit CEO Details Movement Of Stolen Assets
Zhou’s “4.21.25 Executive Summary on Hacked Funds” revealed that the total amount stolen amounts to approximately $1.4 billion, primarily comprising around 500,000 Ethereum (ETH).
The breakdown of the hacked funds indicates that 68.57% remain traceable, suggesting that a significant portion of the stolen crypto can still be tracked through the blockchain.
Conversely, 27.59% have gone dark, meaning these funds are no longer traceable and may be lost. Additionally, 3.84% of the funds have been frozen, potentially due to interventions from law enforcement or regulatory bodies.
The untraceable funds largely flowed into mixers—services that obscure the origin of cryptocurrencies—before being moved through bridges to peer-to-peer (P2P) and over-the-counter (OTC) platforms.
One of the mixers identified in the laundering of the stolen funds is Wasabi, linked to the Democratic People’s Republic of Korea (DPRK). According to Zhou, after a specific amount of Bitcoin (BTC) was processed through Wasabi, it subsequently entered other mixing services such as CryptoMixer, Tornado Cash, and Railgun.
The hackers reportedly utilized various cross-chain and swap services, including Thorchain, eXch, Lombard, LiFi, Stargate, and SunSwap, to facilitate the movement of assets.
The ultimate destination for these funds appears to be OTC or P2P fiat currency exchange services, which allow for the conversion of cryptocurrencies into traditional currencies without the need for a centralized exchange.
Stolen Crypto Breakdown
The update also sheds light on the whereabouts of the stolen assets. A substantial portion of Ethereum has been transferred, with 432,748 ETH—approximately 84.45% of the total—valued at around $1.21 billion, converted from Ethereum to Bitcoin via Thorchain.
Of this amount, 67.25% (342,975 ETH, valued at about $960.33 million) has been converted into 10,003 BTC, distributed across 35,772 wallets with an average of 0.28 BTC each.
Meanwhile, 1.17% (5,991 ETH, approximately $16.77 million) remains on the Ethereum blockchain across 12,490 wallets, averaging 0.48 ETH each. In terms of Bitcoin, 944 BTC—about 6.34%, valued at $90.62 million—has been sent to the Wasabi Mixer, while 531 BTC (equivalent to 18,206 ETH, or 3.57%) has been transferred back from Bitcoin to Ethereum via Thorchain.
In light of the ongoing investigation, Bybit has received 5,443 bounty reports related to the hack over the past 60 days, with 70 of those deemed valid. Zhou emphasized the need for more community involvement, inviting bounty hunters to help decode mixers and assist in tracing the remaining stolen funds.
Featured image from DALL-E, chart from TradingView.com
