Bybit Reports $1.4 Billion Theft, 27.59% Untraceable

Bybit, a prominent cryptocurrency exchange, has provided an update on the March 20th funds theft incident. According to the announcement by Bybit CEO Ben Zhou, the total amount of stolen funds reached $1.4 billion, equivalent to approximately 500,000 ETH. Of this amount, 68.57% remains traceable, while 27.59% has become untraceable, and 3.84% has been successfully frozen.

The untraceable funds were primarily directed into a mixer, which then facilitated their transfer through a cross-chain bridge to various peer-to-peer (P2P) and off-exchange trading platforms. Observations indicate that the North Korean hacker group, commonly referred to as the DPRK, utilized the Wasabi mixer for this purpose. After mixing through Wasabi, a small portion of BTC was transferred to other mixers such as CryptoMixer, Tornado Cash, and Railgun. Subsequently, these funds underwent cross-chain exchanges via platforms like Thorchain, eXch, Lombard, LiFi, Stargate, and SunSwap. Ultimately, the funds were directed into off-exchange trading (OTC) or peer-to-peer (P2P) fiat exchange services.

Regarding the movement of ETH, 432,748 ETH, which constitutes 84.45% of the total stolen ETH (approximately $1.21 billion), was transferred from the Ethereum network to BTC via Thorchain. Of this amount, 67.25% (342,975 ETH, approximately $960 million) was exchanged for 10,003 BTC and dispersed across 35,772 wallets, averaging 0.28 BTC per wallet. Additionally, 1.17% (5,991 ETH, approximately $16.77 million) remains in 12,490 wallets on the Ethereum chain, with an average of 0.48 ETH per wallet.

In terms of BTC movement, 944 BTC (6.34%, approximately $90.62 million) entered the Wasabi mixer. Furthermore, 531 BTC (equivalent to 18,206 ETH, 3.57%) was transferred back from the BTC chain to Ethereum via Thorchain.

Over the past 60 days, Bybit has received 5,443 reports, of which 70 were deemed valid. The exchange is actively seeking more bounty hunters capable of breaking the mixer to assist in the recovery efforts.

This incident highlights the ongoing challenges faced by cryptocurrency exchanges in securing their platforms and the need for enhanced security measures to prevent such large-scale thefts. The ability to trace a significant portion of the stolen funds is a positive development, but the untraceable portion remains a concern. The involvement of the DPRK hacker group adds a layer of complexity, as their methods and tools are sophisticated and designed to evade detection.

The situation underscores the importance of collaboration between exchanges, law enforcement agencies, and cybersecurity experts to combat such threats effectively. Bybit's proactive approach in providing updates and seeking assistance from the community is a step in the right direction. However, the ultimate resolution will depend on the collective efforts of all stakeholders involved in the cryptocurrency ecosystem.