Hacker Launders $614M in 5 Days, THORChain Fees Surge; FBI Blames North Korea

The hacker behind the $1.4 billion Bybit exploit has already laundered more than 50% of the stolen Ethereum, primarily using THORChain to swap ETH for Bitcoin. According to blockchain analytics firm Spot On Chain, the attacker has laundered 266,309 Ethereum (ETH), about $614 million, in the past 5 days at an average rate of 48,420 ETH per day. If this pace continues, the remaining 233,086 ETH could be fully laundered within another five days.

The hacker’s money-laundering rampage has caused a record-breaking spike in THORChain (RUNE) activity. Daily transaction volumes increased dramatically from an average of $80 million to $580 million per day starting on Feb. 22. In just five days, the total transaction volume reached $2.91 billion, with THORChain earning $3 million in fees from the increased usage. Feb. 26 alone saw a record-breaking $859.61 million in swaps, followed by an additional $210 million on Feb. 27, pushing the two-day total past $1 billion.

The U.S. Federal Bureau of Investigation officially linked North Korean hackers to the heist on Feb. 26. According to the FBI, the Bybit hack, known as “TraderTraitor,” is part of a wider series of cyberattacks attributed to North Korean state-sponsored hackers.

Forensic investigations by Sygnia Labs and Verichain confirmed that Bybit’s security infrastructure remained intact despite the breach. A detailed post-mortem of the hack revealed that the vulnerability was linked to a Safe Wallet developer machine that had been compromised. The attackers exploited this machine to insert malicious JavaScript code into the Gnosis Safe UI, specifically targeting Bybit’s cold wallet. Safe has affirmed that its smart contracts are safe, but the incident shows that hackers are increasingly focusing on infrastructure providers rather than exchanges themselves.

Bybit has launched a website to track the laundering of its stolen funds and is offering a bounty to exchanges that assist in recovering the assets.