Nearly 20% of Bybit’s $1.46b stolen funds ‘gone dark,’ CEO says

Bybit’s CEO says more than $200 million of the $1.46 billion stolen from the exchange has become untraceable due to mixing services.

Bybit‘s CEO Ben Zhou says nearly 20% of the funds are now untraceable, just less than two weeks after the exchange lost over $1.4 billion in a highly sophisticated attack by North Korea-backed hackers. In an X post on March 4, Zhou shared an update on the ongoing investigation into the cyberattack, revealing that around 77% of the stolen funds remain traceable, but nearly 20% has “gone dark” through mixing services.

The hacker primarily used THORChain, a cross-chain liquidity protocol which came under scrutiny for unwillingness to prevent DPRK hackers from laundering the funds, to convert stolen Ethereum (ETH) into Bitcoin (BTC). Approximately 83% of the funds, or around $1 billion, were swapped into BTC across 6,954 wallets.

“This and the coming week is critical for fund freezing as the funds will start to clear at exchanges, otc [over-the-counter] and p2p [peer-to-peer].”

Ben Zhou

As crypto.news reported earlier, while other protocols took steps to prevent the movement of stolen funds, THORChain validators failed to take meaningful action. Pluto, a core contributor, resigned in protest after nodes rejected a governance proposal to halt ETH transactions.

Of the stolen funds, 72% ($900 million) passed through THORChain, which remains traceable, says Zhou. However, around 16% of the funds, totaling 79,655 ETH (~$160 million), have gone dark through ExCH, a centralized crypto mixing service.

Zhou mentioned that the exchange is still waiting for an update on these transactions. Another portion of the funds (~$65 million) also remains untraceable as Zhou says more information is needed from OKX’s Web3 wallet. In addition, the Bybit CEO revealed that 11 parties, including Mantle, ParaSwap, and blockchain sleuth ZachXBT, have helped freeze some of the funds, resulting in over $2.1 million in bounty payouts.