North Korea’s Lazarus Group has reportedly laundered all the 499,000 ETH, roughly $1.39 billion, stolen from the Bybit hack in just 10 days. According to a Mar. 4 post on X by on-chain analyst EmberCN, who has been tracking the stolen funds, much of the Ethereum ( ETH ) was funneled through THORChain ( RUNE ), a decentralized cross-chain liquidity protocol, and converted into Bitcoin ( BTC ). 黑客已经把从 Bybit 盗取的 49.9 万枚 ETH ($13.9 亿) 全部清洗完了，整个过程历时 10 天。 ETH 价格在这个过程中下跌了 23% (从 $2,780 跌到现在的 $2,130)。 而黑客洗钱使用的主要通道 THORChain 也因黑客洗钱获得了 $59 亿的交易量跟 $550 万的手续费收入。 本文由 #Bitget ｜ @Bitget_zh 赞助 https://t.co/osoKNzFhkG pic.twitter.com/QUWuMmV6zH — 余烬 (@EmberCN) March 4, 2025 THORChain has handled $605 million in transactions in the last 24 hours alone. The platform has received criticism for its involvement in facilitating illegal transactions, after recording $5.9 billion in volume and collecting $5.5 million in fees during the laundering process. One critic on X referred to THORChain’s response as “negligence at best, greed at worst.” While other protocols acted accordingly to stop the movement of stolen funds, THORChain validators did not take any meaningful action. Pluto, a core contributor, resigned in protest after a governance proposal to halt ETH transactions was rejected. You might also like: Binance pushes for stricter security regulations following $1.4b Bybit hack Meanwhile, Bybit CEO Ben Zhou has since provided an update on the movement of the stolen assets. In a Mar. 4 post on X, he revealed that 77% of the stolen funds remain traceable, while 20% have gone dark, and 3% have been frozen. 3.4.25 Executive Summary on Hacked Funds: Total hacked funds of USD 1.4bn around 500k ETH, 77% are still traceable, 20% has gone dark, 3% have been frozen. Breakdown: – 83% (417,348 ETH, ~$1B) have been converted into BTC with 6,954 wallets (Average 1.71 btc each) . This and… — Ben Zhou (@benbybit) March 4, 2025 According to Zhou, 83% of the laundered funds were converted into Bitcoin, distributed across 6,954 wallets, with 72% ($900 million) of these funds passing through THORChain. Moreover, after being transferred through ExCH, 16% of the assets became untraceable, and the OKX Web3 Proxy processed another 8% ($100 million). Bybit has since launched Lazarusbounty.com, a fund-tracking website, and it is providing bounties to exchanges that help recover the stolen assets. So far, $2.17 million in rewards have been paid to 11 bounty hunters, with Mantle, Paraswap, and ZachXBT among the top contributors. Read more: Safe Wallet responds to Bybit hack with major security improvements
