Bybit CEO Reveals Two-Thirds of Lazarus-Hacked Crypto Still Trackable

In a striking development following one of the largest crypto exchange hacks in history, Bybit CEO Ben Zhou revealed that nearly 70% of the $1.4 billion worth of digital assets stolen in February by the notorious Lazarus Group remain traceable. 

The update comes as part of an executive summary shared by Zhou on April 21 via social media platform X, shedding light on the ongoing efforts to recover the stolen funds.

Hack Overview: $1.4 Billion Lost, But Not Gone

The hack, attributed to the North Korea-linked Lazarus Group, exploited vulnerabilities in Bybit’s cold wallet infrastructure. Of the total amount stolen, Zhou confirmed that 68.6% is still traceable, 27.6% has gone dark, and 3.8% has been frozen.

A large portion of the stolen funds — approximately 432,748 ETH, or 84% of the total stolen — was routed from Ethereum to Bitcoin using THORChain. Zhou reported that about $960 million in Ether was converted into 10,003 BTC across more than 35,000 wallets. Additionally, roughly $17 million in ETH remains on Ethereum, spread across over 12,000 wallets.

Despite the complexity of laundering efforts — which involved mixers like Wasabi and cross-chain platforms such as eXch, Lombard, Stargate, and SunSwap — a substantial portion of the crypto trail remains visible to investigators.

Bounty Program and Efforts to Track Funds

To combat the laundering, Bybit launched a $140 million Lazarus Bounty program in February, offering rewards for information leading to the recovery or freezing of stolen assets. However, out of 5,443 bounty reports submitted over 60 days, only 70 were deemed valid. To date, just $2.3 million has been paid out — with the majority of the reward going to Mantle, a layer-2 platform that helped freeze $42 million worth of funds.

Zhou acknowledged the ongoing challenge of tracking crypto that has passed through mixers and cross-chain services, emphasizing the need for more skilled bounty hunters. “We welcome more reports, we need more bounty hunters that can decode mixers, as we need a lot of help down the road,” he urged.

The aftermath of the hack has already begun to impact services implicated in the laundering process. Notably, the eXch crypto exchange announced on April 17 that it will cease operations by May 1 after reports linked it to the flow of hacked Bybit funds.

As investigations continue, Bybit and the broader crypto community remain on high alert, watching closely to see if further breakthroughs can bring more of the stolen assets back into the light.