{"id":48526,"date":"2025-03-04T12:01:56","date_gmt":"2025-03-04T12:01:56","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/bybit-ceo-confirms-that-280m-of-the-stolen-1-4b-is-no-longer-traceable\/"},"modified":"2025-03-04T12:01:56","modified_gmt":"2025-03-04T12:01:56","slug":"bybit-ceo-confirms-that-280m-of-the-stolen-1-4b-is-no-longer-traceable","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/bybit-ceo-confirms-that-280m-of-the-stolen-1-4b-is-no-longer-traceable\/","title":{"rendered":"Bybit CEO confirms that $280M of the stolen $1.4B is no longer traceable"},"content":{"rendered":"<p><b>(Originally posted on : CoinJournal: Latest Crypto News, Altcoin News and Cryptocurrency Comparison )<\/b><br \/>\n<\/p>\n<div data-site=\"CoinJournal\">\n<div class=\"-mt-16  mb-8  lg:-mt-20  rounded-md  shadow-md\">\n<div class=\"relative  z-10  post-article-image  rounded  overflow-hidden\" data-site=\"CoinJournal\">\n<picture><source srcset=\"https:\/\/coinjournal.net\/wp-content\/uploads\/imagecache\/2022\/11\/04-Hack-1-smartcrop-750x375.webp\" type=\"image\/webp\" media=\"(min-width: 750px)\"\/><source srcset=\"https:\/\/coinjournal.net\/wp-content\/uploads\/imagecache\/2022\/11\/04-Hack-1-smartcrop-363x181.webp\" type=\"image\/webp\"\/><source srcset=\"https:\/\/coinjournal.net\/wp-content\/uploads\/imagecache\/2022\/11\/04-Hack-1-smartcrop-750x375.jpg\" type=\"image\/jpeg\" media=\"(min-width: 750px)\"\/><source srcset=\"https:\/\/coinjournal.net\/wp-content\/uploads\/imagecache\/2022\/11\/04-Hack-1-smartcrop-363x181.jpg\" type=\"image\/jpeg\"\/>\n<\/picture>                            <\/div>\n<\/p><\/div>\n<ul>\n<li>Bybit CEO has said that 20% of the $1.4B stolen from the exchange is now untraceable.<\/li>\n<li>Hackers converted $1B in ETH to BTC via THORChain and spread it.<\/li>\n<li>So far, 11 bounty hunters have assisted in freezing $42M of the stolen funds.<\/li>\n<\/ul>\n<p>In a stunning update, Bybit CEO Ben Zhou has revealed that $280 million of the $1.4 billion stolen from the cryptocurrency exchange in <a href=\"https:\/\/coinjournal.net\/news\/bybit-suffers-1-4-billion-hack-eth-drained-from-exchange-wallet\/\">the February hack<\/a> has vanished into untraceable channels.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">3.4.25 Executive Summary on Hacked Funds: <br \/>Total hacked funds of USD 1.4bn around 500k ETH, 77% are still traceable, 20% has gone dark, 3% have been frozen. <br \/>Breakdown: <br \/>\u2013 83%  (417,348 ETH, ~$1B) have been converted into BTC with 6,954 wallets (Average 1.71 btc each) . This and\u2026<\/p>\n<p>\u2014 Ben Zhou (@benbybit) <a href=\"https:\/\/twitter.com\/benbybit\/status\/1896798476945744010?ref_src=twsrc%5Etfw\">March 4, 2025<\/a><\/p>\n<\/blockquote>\n<p>The security breach, <a href=\"https:\/\/coinjournal.net\/news\/north-koreas-lazarus-group-behind-hack-as-bybit-loses-1-5b\/\">attributed to the North Korean hacking group Lazarus<\/a>, saw approximately 500,000 Ether (ETH) pilfered from Bybit\u2019s reserves. While the majority of the funds remains visible on the blockchain, Zhou\u2019s announcement underscores the challenges facing investigators as they race against time to freeze the assets before the hackers fully cash out.<\/p>\n<p>The attack exploited vulnerabilities in SafeWallet, a third-party wallet platform used by Bybit. Lazarus hackers compromised a developer\u2019s device, injecting malicious code that allowed them to siphon off nearly $1.5 billion in ETH during a routine transfer.<\/p>\n<p>Despite Bybit\u2019s swift action to restore 1:1 backing of client assets within days, the hackers have been relentlessly moving the stolen funds across multiple platforms, complicating recovery efforts.<\/p>\n<h2>Hackers leveraged THORChain to fragment funds<\/h2>\n<p>A significant portion of the stolen Ether\u2014417,348 ETH valued at around $1 billion\u2014has been converted into Bitcoin (BTC) and scattered across 6,954 wallets, each holding an average of 1.71 BTC.<\/p>\n<p>Zhou noted that 72% of the haul, or 361,255 ETH worth $900 million, was funneled through THORChain, a decentralized exchange known for its privacy features.<\/p>\n<p>THORChain alone processed a record $4.66 billion in swaps in the week ending March 2, raking in over $5.5 million in fees from these illicit transactions. This fragmentation and conversion strategy has made tracking the funds increasingly difficult for blockchain forensic teams.<\/p>\n<p>Meanwhile, 20% of the stolen assets\u2014approximately 79,655 ETH\u2014have \u201cgone dark,\u201d meaning they\u2019ve been laundered through platforms like ExCH and rendered untraceable.<\/p>\n<p>Zhou highlighted that an additional 40,233 ETH, worth $100 million, passed through OKX\u2019s Web3 Proxy. Of this, 23,553 ETH ($65 million) remains untraceable without further cooperation from the OKX Wallet team, while 16,680 ETH is still within reach of investigators.<\/p>\n<p>The CEO stressed that the next one to two weeks are pivotal as the hackers prepare to offload their haul via exchanges, over-the-counter (OTC) trading desks, and peer-to-peer (P2P) networks.<\/p>\n<h2>Bybit has enlisted bounty hunters amid freezing efforts<\/h2>\n<p>In a bid to thwart the hackers, Bybit has enlisted the help of bounty hunters and security firms.<\/p>\n<p>Zhou reported that 11 parties\u2014including prominent players like Mantle, Paraswap, and blockchain sleuth ZachXBT\u2014have assisted in freezing $42 million, or 3% of the stolen funds.<\/p>\n<p>So far, Bybit has paid out $2.178 million in USDT to these contributors as part of its recovery efforts, with more details available at Lazarusbounty.com. The exchange also partnered with Web3 security firm ZeroShadow on February 25 to enhance its blockchain forensics and maximize asset recovery.<\/p>\n<p>Despite these efforts, the hackers show no signs of slowing down. Blockchain analytics firm Elliptic has identified over 11,000 wallets linked to the Lazarus group, suggesting a sprawling network designed to obscure their tracks.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">\ud83d\udea8 Free Real-time Bybit Exploit Data \ud83d\udea8<\/p>\n<p>Elliptic has launched a free data feed of illicit addresses linked to the Bybit exploit.<\/p>\n<p>\ud83d\udd0d Why it matters:<\/p>\n<p>\u2705 Minimize exposure to sanctions<br \/>\u2705 Stop laundering of stolen funds<br \/>\u2705 Strengthen crypto security<\/p>\n<p>Access via CSV or API \u2b07\ufe0f\u2026 <a href=\"https:\/\/t.co\/U9Qa2tc8Zz\">pic.twitter.com\/U9Qa2tc8Zz<\/a><\/p>\n<p>\u2014 Elliptic (@elliptic) <a href=\"https:\/\/twitter.com\/elliptic\/status\/1894398213479629049?ref_src=twsrc%5Etfw\">February 25, 2025<\/a><\/p>\n<\/blockquote>\n<p>Zhou indicated that an additional $65 million in ETH could be salvaged with OKX\u2019s support, but time is running out as the attackers continue laundering operations through platforms like ExCH and OKX Web3 Proxy.<\/p>\n<div class=\"post-meta\">\n<hr class=\"mb-6\"\/>\n<h6 class=\"text-3xl  mb-4  text-green-300\">Share this article<\/h6>\n<hr class=\"mb-6\"\/>\n<h6 class=\"text-3xl  mb-4  text-green-300\">Categories<\/h6>\n<hr class=\"mb-6\"\/>\n<h6 class=\"text-3xl  mb-4  text-green-300\">Tags<\/h6>\n<\/p><\/div>\n<\/p><\/div>\n<p><script async src=\"\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><br \/>\n<br \/><a href=\"https:\/\/coinjournal.net\/news\/bybit-ceo-confirms-that-280m-of-the-stolen-1-4b-is-no-longer-traceable\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : CoinJournal: Latest Crypto News, Altcoin News and Cryptocurrency Comparison ) Bybit CEO has said that 20% of the $1.4B stolen from the exchange is now untraceable. Hackers converted $1B in ETH to BTC via THORChain and spread it. So far, 11 bounty hunters have assisted in freezing $42M of the stolen [&hellip;]<\/p>\n","protected":false},"author":7,"featured_media":48527,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[35],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/48526"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=48526"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/48526\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/48527"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=48526"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=48526"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=48526"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}