In a race against time, Bybit CEO reveals that most of the record-breaking stolen crypto remains traceable as hackers scramble to launder billions.

Over 77% of the funds stolen in the largest crypto exchange hack in history remain traceable on blockchain networks, according to Bybit CEO Ben Zhou. In an update posted early Tuesday on X, Zhou confirmed that approximately $1 billion worth of stolen cryptocurrency can still be tracked, while offering a critical window for recovery efforts.

“This and the coming week is critical for fund freezing as the funds will start to clear at exchanges, otc and p2p,” Zhou warned, highlighting the urgency in the ongoing efforts to recover customer assets.

The Heist Breakdown

The attack, attributed to the notorious North Korean hacking group Lazarus, targeted Bybit in late February through an ingenious method. The hackers injected malicious code into SafeWallet, a third-party wallet platform integrated with the exchange. By compromising a developer’s device, they manipulated a routine wallet transfer operation, successfully draining nearly $1.5 billion in Ethereum (ETH) from the platform.

The current status of the stolen funds reveals a complex money laundering operation in progress:

• 417,348 ETH (approximately $1 billion) remains traceable after being moved through privacy-focused THORChain
• 79,655 ETH (roughly $200 million) has “gone dark” through ExCH
• 40,233 ETH ($100 million) passed through OKX’s web3 proxy
• 23,553 ETH ($65 million) remains completely untraceable

Sophisticated Laundering Techniques

Zhou detailed that the hackers have already converted 83% of the stolen ETH—361,255 ETH worth approximately $900 million—into Bitcoin (BTC). In an apparent attempt to complicate tracking efforts, they’ve distributed these funds across 6,954 different wallets, averaging just 1.71 BTC per wallet, using THORChain as their primary conversion mechanism.

The privacy-focused THORChain protocol has processed a record $4.66 billion in swaps during the week ending March 2, according to data from DefiLlama. This surge in activity has generated over $5.5 million in fees from processing these potentially illicit transactions.

Recovery Efforts Underway

Despite the massive scale of the theft, Bybit has managed to restore a 1:1 backing of client assets within days after the attack. Address activity suggests the exchange purchased more than $400 million through over-the-counter trading, with another $300 million acquired directly from exchanges to make their customers whole.

As the crypto community watches this high-stakes chase unfold, the next few days will prove crucial in determining how much of the stolen fortune can be recovered before it disappears permanently into the murky depths of the crypto underworld.