Bybit CEO Ben Zhou has revealed that a significant portion of the $1.4 billion stolen from the exchange in February has become untraceable. According to Zhou, 20% of the funds have “gone dark,” while 77% remains traceable, and 3% has been frozen.
The theft, which occurred on February 21, is considered the largest hack ever on a centralized crypto exchange. It was attributed to a targeted malware attack by the Lazarus Group, resulting in the loss of approximately 400,000 ETH and about 113,000 ETH-related tokens.
Zhou stressed the urgency of the situation, stating, “This and the coming week is critical for fund freezing as the funds will start to clear at exchanges, OTC and P2P.” He indicated that the next two weeks are crucial for recovering the assets.
The CEO provided a breakdown of the stolen funds’ movement. He explained that approximately 16% of the funds, totaling 79,655 ETH, were routed through the non-KYC exchange eXch and are currently untraceable. “Still waiting for update,” Zhou noted.
Additionally, $100 million worth of ether was channeled through the OKX Web3 proxy, with $65 million of those funds remaining untraceable, pending further information from OKX Web3.
According to Zhou, hackers converted 83% of the stolen ether into bitcoin and distributed it across 6,954 wallets. A significant portion, 72% of the converted amount, was processed through THORChain.
This activity may have contributed to THORChain’s record-breaking weekly volume, which reached $4.67 billion last week, according to data from DefiLlama.
The utilization of THORChain by the North Korean hackers sparked internal debates about the platform’s role. As TCB, a key member of THORChain, wrote, “The ethos about being decentralized are just ideas. When the huge majority of your flows are stolen funds from North Korea for the biggest money heist in human history, it will become a national security issue, this isn’t a game anymore.” TCB has since announced his departure from the protocol.
TCB also stated that “the protocol is holding a vote to temporarily halt ETH on the platform until it finds a solution,” although THORChain has yet to announce a decision.
In contrast, cross-chain DEX Chainflip halted its swapping platform immediately after detecting activity by Bybit hackers and announced upgrades to prevent hacked funds from entering the protocol.
