David Edwards
Ben Zhou, co-founder and CEO of the cryptocurrency exchange Bybit, verified that more than two-thirds of the $1.4 billion that North Korea’s Lazarus Group stole can still be tracked down.
Zhou described the state of the stolen digital assets after the February breach, which was the biggest to date against a cryptocurrency exchange, in an executive summary published on X on April 21. 3.8% of the entire amount of compromised monies have been blocked, 27.6% have “gone dark,” and 68.6% are still traceable.
According to Zhou, most of the untraceable assets were transferred to over-the-counter (OTC) and peer-to-peer (P2P) trading platforms using bitcoin mixers and cross-chain bridges.
“Recently, we have observed that the mixer mainly used by the DPRK [Democratic People’s Republic of Korea] is Wasabi,” Zhou stated, noting that smaller amounts were later funneled through CryptoMixer, Tornado Cash, and Railgun.
Mixers and Bridges in a Complicated Laundering Scheme
Zhou verified that the Wasabi mixer processed about 944 Bitcoin (BTC), which is worth almost $90 million. Before money entered P2P and OTC services, other laundering activities included cross-chain exchanges through platforms such as THORChain, eXch, Lombard, LI.FI, Stargate, and SunSwap.
Ether’s (ETH) movement was just as intricate. Through THORChain, about 432,748 ETH—or almost 84% of the stolen Ether—was exchanged for Bitcoin, with a total estimated worth of $1.21 billion. Approximately $960 million worth of Ether has been converted into 10,003 Bitcoin, which is being distributed among 35,772 wallets.
According to Zhou, there is still roughly $17 million worth of Ether spread across 12,490 wallets on the Ethereum network.
The total value of stolen cryptocurrency assets is still being constantly monitored at over $1.2 billion.
Bybit’s Bounty Efforts Produce Moderate Outcomes
Bybit announced the Lazarus Bounty program after the hack, offering $140 million in incentives for information that resulted in the recovery of assets. But according to Zhou, only 70 of the 5,443 bounty submissions were accepted. Bybit has paid out $2.3 million to 12 bounty seekers so far.
Notably, the majority of the bounty payouts went to the Mantle layer-2 platform for its assistance in freezing about $42 million in stolen money.
“We welcome more reports. We need more bounty hunters that can decode mixers, as we need a lot of help there down the road,” Zhou urged.
Separately, the cryptocurrency exchange eXch, which was linked to the laundering of Bybit hack funds, declared that it would shut down on May 1.
