TL;DR
- High Traceability: Bybit CEO confirms that 88% of the $1.4B hack’s stolen funds remain traceable, providing hope for potential recovery.
- Complex Laundering: Approximately 440K ETH has been converted to BTC and dispersed across over 9,000 wallets, with sophisticated mixers like Tornado Cash complicating the tracing process.
- Active Recovery: Bybit has frozen a portion of the funds and offered bounties to ethical hackers, rallying further support to track and potentially recover the misappropriated assets.
The crypto industry was rocked by the largest hack in its history when Bybit, a leading exchange, suffered a staggering $1.4 billion loss in February 2025. The stolen assets included liquid-staked Ether (stETH), Mantle Staked ETH (mETH), and other digital currencies.
Blockchain security firms have identified the North Korean Lazarus Group as the likely perpetrators, employing sophisticated techniques to launder the stolen funds. Despite the attackers’ efforts to obscure their tracks, Bybit CEO Ben Zhou has confirmed that 88% of the stolen funds remain traceable. This revelation offers a glimmer of hope for recovery in an otherwise grim scenario.
Tracing the Stolen Funds
According to ByBit CEO, Ben Zhou, approximately 440,091 ETH, valued at $1.23 billion, has been converted into 12,836 BTC and distributed across 9,117 wallets. The average wallet holds 1.41 BTC. The stolen funds have primarily been funneled through Bitcoin mixers such as Wasabi, CryptoMixer, Railgun, and Tornado Cash, making the tracing process more challenging.
3.20.25 Executive Summary on Hacked Funds:
Hacker started to use mixers: 1. Wasbi 2. CryptoMixer 3. Railgun 4. TornadoCash
Total hacked funds of USD 1.4bn around 500k ETH. 88.87% remain traceable, 7.59% have gone dark, 3.54% have been frozen.
Breakdown: – 86.29% (440,091 ETH,…— Ben Zhou (@benbybit) March 20, 2025
Bybit has already frozen 3.5% of the stolen funds, while 7.6% have gone dark, becoming untraceable. The exchange has also paid out $2.2 million in bounties to ethical hackers and blockchain investigators who have provided valuable information on the Lazarus Group’s transaction patterns.
Challenges in Recovery
The Lazarus Group’s use of decentralized cross-chain protocols and advanced mixing services has complicated efforts to recover the stolen assets. Decoding transaction patterns through these mixers remains the most significant challenge for blockchain security experts. Bybit has called for more “bounty hunters” to assist in this effort, offering 10% of any recovered funds as a reward.
Implications for the Crypto Industry
This incident serves as a stark reminder of the vulnerabilities even centralized exchanges with robust security measures face. Analysts have pointed to human error as a critical factor in enabling the hack, emphasizing the need for heightened vigilance and improved security protocols.
While the road to recovery is fraught with challenges, the traceability of 88% of the stolen funds provides a foundation for optimism. Bybit’s proactive measures and the collaborative efforts of blockchain investigators highlight the industry’s resilience in the face of adversity.
