Bybit CEO Says $960M in Stolen Crypto Still Traceable After Lazarus Hack
Bybit CEO Ben Zhou revealed that a significant portion of the $1.4 billion stolen from the exchange during a February 2025 hack—linked to North Korea’s Lazarus Group—remains traceable, despite attempts to obfuscate the funds.
In an update shared on X on April 21, Zhou stated that 68.6% of the stolen assets are still traceable, while 27.6% have “gone dark” and only 3.8% has been successfully frozen.
Largest Crypto Hack in History: How the Funds Moved
The hack, which targeted Bybit’s cold wallet infrastructure, is now considered the largest exchange breach to date. According to Zhou, hackers moved stolen funds through a series of advanced laundering techniques, starting with Wasabi Wallet, a privacy-focused Bitcoin mixer heavily used by Lazarus operatives.
“944 BTC (~$90 million) was washed through Wasabi,” Zhou confirmed.
Afterward, smaller amounts were funneled through CryptoMixer, Tornado Cash, and Railgun. From there, the funds were bridged and swapped across multiple ecosystems, including:
- THORChain
- eXch
- Lombard
- LI.FI
- Stargate
- SunSwap
Eventually, the assets landed in peer-to-peer (P2P) and over-the-counter (OTC) trading networks, making further tracking increasingly difficult.
4.21.25 Executive Summary on Hacked Funds:
Total hacked funds of USD 1.4bn around 500k ETH. 68.57% remain traceable, 27.59% have gone dark, 3.84% have been frozen. The untraceable funds primarily flowed into mixers then through bridges to P2P and OTC platforms.
Recently, we have…— Ben Zhou (@benbybit) April 21, 2025
Ethereum Funds Converted to BTC Across Thousands of Wallets
A majority of the stolen Ether—432,748 ETH, worth $1.21 billion—was swapped into Bitcoin using THORChain, Zhou revealed. Of that, around $960 million in ETH was converted into 10,003 BTC, distributed across 35,772 wallets.
Only $17 million worth of Ether remains on the Ethereum blockchain, spread across 12,490 wallets.
Despite the scale of the operation, Zhou emphasized that Bybit continues working with blockchain analytics firms and law enforcement agencies to recover funds and track down the attackers.
Kosta has reported on cryptocurrency markets and blockchain infrastructure since 2020, bringing over six years of hands-on experience in the crypto industry built through daily tracking of markets, trends, and emerging blockchain developments. Specializing in Bitcoin on-chain analysis, institutional ETF flows, and digital asset price action, his work at Coindoo has been cited by other news agencies and consistently covers market developments with a focus on data-driven reporting across Bitcoin, Ethereum, Solana, and XRP. Over the years, Kosta has contributed to multiple crypto media outlets in different regions, authoring over 6,000 articles across the sector. His reporting spans cryptocurrency markets and the broader fintech industry, tracking not only price action but also the technological and regulatory forces shaping the ecosystem. To support his analysis, Kosta actively leverages on-chain data and metrics from leading platforms such as Santiment, Glassnode, and CryptoQuant, enabling deeper, evidence-based market insights. He believes in the power of transparency and the data that underpins the blockchain ecosystem. His academic background in Marketing Management from Denmark further complements his analytical approach, adding a strong understanding of communication strategy and content positioning to his work.
