Bybit CEO: Tracking the Lazarus Group’s $1.4B Heist

Bybit’s CEO, Ben Zhou, recently revealed an update on the February hack orchestrated by North Korea’s Lazarus Group. This incident, resulting in the theft of $1.4 billion, remains one of the largest crypto exchange hacks in history.

In a post on X, Zhou detailed the current status of the stolen funds. A significant portion, 68.6%, remains traceable, providing a glimmer of hope for recovery. However, 27.6% has vanished into the cryptocurrency’s shadowy underbelly, while 3.8% has been successfully frozen. The untraceable funds primarily flowed through cryptocurrency mixers, navigating bridges to P2P and OTC platforms.

Zhou highlighted the role of Wasabi, a mixer frequently used by North Korean actors. From there, a fraction of the funds moved through CryptoMixer, Tornado Cash, and Railgun. He further specified that 944 BTC (approximately $90 million) passed through Wasabi, while 432,748 ETH (about 84% of the total ETH stolen) was transferred to Bitcoin via THORChain.

A considerable amount, roughly two-thirds, of that ETH was converted into 10,003 BTC. The remaining ETH, valued at approximately $17 million, persists on the Ethereum blockchain. Bybit’s efforts to track the funds have involved working with various platforms including THORChain, eXch, Lombard, LI.FI, Stargate, and SunSwap.

Bybit’s Bounty Program: A Hunt for Hackers

In February, Bybit initiated the Lazarus Bounty program, offering a staggering $140 million reward for information leading to the recovery of frozen funds. Despite receiving 5,443 reports, only 70 proved valid. To date, Bybit has disbursed $2.3 million to 12 bounty hunters, with the Mantle layer-2 platform receiving a significant portion for securing $42 million in frozen assets.

Zhou emphasized the need for more bounty hunters with expertise in deciphering mixers, as this critical aspect of the investigation requires further assistance. The closure of the eXch cryptocurrency exchange, allegedly due to involvement in laundering funds from the Bybit hack, underscores the complexity and ongoing nature of the investigation.