Bybit Traces Most of Lazarus Group’s $1.4 Billion Crypto Haul

Bybit CEO Ben Zhou has opened up about the complex and ongoing efforts to track the $1.4 billion crypto theft tied to North Korea’s Lazarus Group. His update paints a picture of how massive and technical the laundering process has been.

Good to know

• Only 3.84% of the $1.4 billion in stolen crypto has been frozen so far.
• Around 500,000 ETH, or 68.57% of the hacked funds, are still traceable.
• Over 35,000 wallets were used to scatter and hide stolen assets.

According to Zhou, a large chunk of the stolen Ethereum—roughly 500,000 ETH—can still be followed on-chain. That accounts for 68.57% of the missing assets. On the flip side, 27.59% of the funds have slipped out of reach after being pushed through multiple privacy tools and cross-chain transactions. So far, only 3.84% of the total haul has been frozen.

The hackers used crypto mixers like Wasabi to help erase their footprints. These tools make transactions harder to track by scrambling and masking flows. Once the funds were anonymized, they crossed bridges to various platforms, including peer-to-peer and over-the-counter markets.

One of the more technical steps involved Thorchain, which was used to swap about 432,748 ETH into Bitcoin. Those Bitcoin funds didn’t sit still—they were divided and spread across more than 35,000 wallets, making recovery nearly impossible without serious community help.

Even after all the mixing, some Ethereum is still sitting out in the open. Zhou pointed out that 5,991 ETH—worth about $16.77 million—is scattered across 12,490 wallets. On average, each holds just 0.48 ETH, which adds another layer of difficulty for investigators.

Meanwhile, the Bitcoin laundering trail is just as complicated. About 944 BTC ($90.6 million) went through Wasabi Mixer, while 531 BTC (roughly 18,206 ETH) was bridged back into Ethereum via Thorchain. That move muddied the waters even more, making the funds’ origin tough to pinpoint.

To push back, Bybit rolled out the Lazarus Bounty program. It’s aimed at crowdsourcing tips from the crypto community. Over 5,400 reports have come in, with 70 confirmed as legitimate leads. Zhou made it clear, though—more eyes are needed, especially to decipher mixer-related transactions that are currently holding back progress.

Adding more fuel to the fire, the privacy-focused exchange eXch confirmed it will shut down on May 1. The move comes after it admitted to handling a portion of the stolen crypto. Though the amount was small, the involvement raised serious questions about the role such platforms play in laundering digital assets.

Zhou wrapped up his update with a warning. As the hackers continue to move money, expect mixer activity to spike. He’s calling on blockchain sleuths to stay alert and keep tracking.