Bybit CEO Ben Zhou has provided a detailed update on the $1.4 billion cryptocurrency theft linked to North Korea’s Lazarus Group. According to Zhou, 68.57% of the stolen Ethereum, around 500,000 ETH, can still be traced, while 27.59% has become untraceable after being moved through complex laundering methods.
Just 3.84% of the stolen assets have been frozen so far.
Funds Laundered Through Mixers and Bridges
Zhou explained that the attackers used various crypto mixers, including Wasabi mixer, to cover their tracks. These tools are designed to make blockchain transactions harder to trace. After passing through mixers, the stolen funds were sent across bridges to peer-to-peer and over-the-counter platforms.
A major portion of the stolen Ethereum, around 432,748 ETH, was converted into Bitcoin using Thorchain. From there, the assets were split up and spread across over 35,000 wallets. On the Ethereum blockchain, 5,991 ETH, worth approximately $16.77 million, is still visible, scattered across 12,490 wallets with an average of just 0.48 ETH each.
Bitcoin Mixing and Bridging Back to Ethereum
On the Bitcoin side, 944 BTC (valued at $90.6 million) was processed through Wasabi Mixer. Additionally, 531 BTC, roughly equal to 18,206 ETH or 3.57% of the stolen assets, was bridged back into Ethereum through Thorchain, making the flow of stolen crypto even harder to follow.
Community Bounty Program and Ongoing Challenges
To aid recovery efforts, Bybit launched the Lazarus Bounty program, encouraging the crypto community to submit tips. So far, 5,443 reports have been submitted, with 70 confirmed as valid leads. Zhou said more help is needed, especially in decoding mixer transactions to identify the remaining funds.
He also warned that as more funds try to exit the blockchain, mixer activity will likely increase. Meanwhile, privacy-focused exchange eXch has announced it will shut down on May 1, following accusations of helping launder the stolen crypto. The exchange admitted to handling a small portion of the hacked funds.