Bybit Hack: $280M Laundered, But Majority of Stolen Funds Still Trackable

Bybit CEO Ben Zhou has confirmed that $280 million of the $1.4 billion stolen in the February cyberattack has been successfully laundered, making it nearly impossible to trace. However, around $1.07 billion remains trackable, giving investigators a crucial window to recover the remaining funds.

In an update shared on March 4, Zhou detailed the movement of 500,000 ETH siphoned from the exchange, explaining that while 77% of the stolen assets can still be monitored, 20% has “gone dark.” This suggests the funds were mixed, laundered, or funneled into platforms that obscure transactions, a tactic frequently used by North Korean-linked hackers.

The remaining 3%—roughly $42 million—has already been frozen through ongoing investigative efforts. Authorities are now working against the clock, as the next one to two weeks will be critical in preventing the hackers from cashing out further stolen assets.

Bybit Attackers Shift Funds to Bitcoin

One of the biggest challenges in the recovery process is the sophisticated laundering techniques used by the attackers. Zhou revealed that the hackers converted around $1 billion of the stolen ETH—approximately 417,348 ETH—into Bitcoin. These funds were then fragmented across 6,954 cryptocurrency wallets, with an average holding of just 1.71 BTC per wallet, making it significantly harder to track and seize the assets.

To cash out their loot, the attackers primarily used THORChain, a decentralized exchange known for its cross-chain swapping capabilities, which allows users to move assets between different blockchains without relying on centralized platforms. Other services, including ExCH and OKX Web3 Proxy, were also leveraged to obscure the stolen funds’ origins.

Despite these challenges, Zhou remains optimistic that some of the funds can still be recovered. He noted that approximately $65 million worth of ETH could be frozen with assistance from the OKX Wallet team.

Bounty Hunters and Blockchain Analysts Join the Hunt

As part of its recovery efforts, Bybit has turned to both blockchain security firms and independent bounty hunters. Since February 25, the exchange has been working with Web3 security firm ZeroShadow to track and freeze stolen assets. Additionally, blockchain analytics firm Elliptic has identified more than 11,000 wallets linked to the Bybit hackers.

The exchange has also enlisted the help of bounty hunters, awarding $2.1 million in total rewards to individuals who have contributed to freezing stolen funds.