Bybit CEO Reveals Nearly 30% of $1.4B Hack Funds Has ‘Gone Dark’ After Mixer Use

Bybit Hack Fallout Grows As Over $1.4B In Crypto Still Being Tracked

Nearly two months after a record-breaking $1.4 billion crypto hack hit Bybit, a large portion of the stolen assets remains traceable—despite complex laundering attempts involving mixers, cross-chain bridges, and decentralised exchanges.

On 21 April 2025, Bybit CEO Ben Zhou shared an update on X about the stolen assets' whereabouts, noting that while most remain trackable, a significant portion has already “gone dark.”

How The Stolen ETH Was Washed Across Chains

Zhou confirmed that around 500,000 ETH were siphoned from the platform following a targeted malware attack believed to have been carried out by North Korea’s Lazarus Group.

The attackers allegedly compromised a Safe{Wallet} developer system and inserted malicious code into the Bybit signers’ interface, redirecting funds in what appeared to be valid transactions.

Of the 500,000 ETH, 432,748 ETH—roughly $1.21 billion or 84.45%—was moved through the cross-chain liquidity protocol Thorchain and converted into 10,003 BTC.

The BTC was then dispersed across 35,772 wallets, each holding just 0.28 BTC on average, a method designed to fragment and obscure the trail.

Nearly 30 Percent Of Stolen Crypto Now Untraceable

In his X post, Zhou reported that 68.57% of the stolen funds remain traceable.

However, 27.59%—around $386 million—has effectively “gone dark” after being funneled through privacy-focused tools.

Only 3.84% of the stolen crypto has been successfully frozen.

The laundering chain began with Wasabi Mixer, which Zhou said is now the “primary tool used by DPRK-linked groups.”

After Wasabi, the funds were further layered through platforms like CryptoMixer, Tornado Cash, and Railgun, before being bridged or swapped across Thorchain, eXch, LiFi, Stargate, Lombard, and SunSwap.

Eventually, the assets were off-ramped to fiat via over-the-counter and peer-to-peer exchanges, further complicating recovery efforts.

Was The Bounty Hunt A True Public Effort?

Bybit launched a bounty programme to trace the stolen funds, offering 10% of any recovered amount.

In the past 60 days, 5,443 reports have been submitted, but only 70 were confirmed as valid.

This unusually low success rate has raised eyebrows within the crypto community.

A X user, Kevin Ang, responded to Zhou’s post by pointing out,

“Transparency appreciated, Ben. But I’ve got one question:

Out of 5,443 bounty reports, only 70 were valid? That level of precision doesn’t sound like crowdsourced discovery—it sounds like insiders already knew what to look for. Were those 70 bounty hunters public contributors, or were they white-hats already close to the fire? Because to outsiders, this feels less like a hunt and more like a post-exploit sanitisation operation.”

Others voiced similar concerns, with another user commenting,

“It’s very odd that we identify no one after stealing this much. We need to crack down and press legal charges; otherwise, it’s become quite normal.”

eXch Confirms Shutdown Amid Legal Heat

Among the platforms identified in the laundering process, eXch—a privacy-first crypto exchange—confirmed it will shut down operations by 1 May 2025.

In its announcement, the team attributed the closure to pressure from an international investigation and denied knowingly assisting in illicit transfers.

The eXch team stated,

“We had to compromise our privacy ideals under the immense pressure that the whole industry had to deal with due to the irresponsible actions of those at ByBit.”

Lazarus Activity Prompts Tech Response

Following public concern over the misuse of decentralised protocols, Chainflip DEX temporarily paused operations to roll out security updates aimed at preventing its misuse in laundering activities.

Meanwhile, despite internal discussions, THORChain opted not to implement restrictions, which led to the departure of several of its members.

Zhou, addressing the ongoing situation, stressed the importance of community efforts,

“We welcome more reports. We need more bounty hunters who can decode mixer activity—we need a lot of help down the road.”

Only 1.17% of the original ETH remains on Ethereum, scattered across 12,490 wallets.

With most of the stolen funds either converted or hidden across various decentralised layers, the case remains one of the most sophisticated digital heists in crypto history.