Hackers Resume Laundering $138M in Stolen ETH; North Korea Linked

The hackers behind the Bybit exchange's $1.4 billion exploit have resumed their laundering activities, moving another 62,200 Ether (ETH) worth $138 million on March 1. This brings the total amount of ETH moved to approximately 343,000, representing 68.7% of the stolen funds. The hackers still have around 156,500 ETH left to be moved, with the remaining funds expected to be cleared in the next three days.

The Lazarus Group, a North Korean hacking organization, is believed to be behind the Bybit hack. The group has been using various methods to launder the stolen ETH, including converting it into Bitcoin (BTC), the Dai (DAI) stablecoin, and other assets through decentralized exchanges, crosschain bridges, and instant swap services without Know Your Customer protocols.

The FBI has shared 51 Ethereum addresses operated by or linked to the Bybit hackers, while blockchain analytics firm Elliptic has flagged over 11,000 crypto wallet addresses possibly linked to them. Crypto forensics firm Chainalysis has also been tracking the hackers' activities and has identified several methods they have used to launder the stolen funds.

The crosschain asset swap protocol THORChain has come under criticism for facilitating a significant share of transfers made by the North Korean hackers. Developers behind the protocol have received heavy criticism for not doing enough to block transactions linked to the hackers. One of THORChain's developers, known as "Pluto," has announced that they will no longer contribute to the protocol after a vote to block North Korean hacker-linked transactions was reverted.

The Bybit hack on Feb. 21 was the largest exploit in the crypto industry, more than doubling losses from the $650 million Ronin bridge hack on March 23, 2022. The hackers gained access to the exchange's hot wallet and stole a significant amount of ETH, causing widespread concern in the crypto community.