North Korean Hackers Launder $140M in Bybit Theft

North Korean hackers have initiated a sophisticated money laundering operation involving over $140 million in stolen funds from the recent Bybit hack, according to blockchain intelligence firm Elliptic. The firm reported that the stolen funds, primarily Ethereum, are being systematically moved through anonymous exchanges and converted to Bitcoin, making it more challenging to trace and recover the assets.

The laundering process involves multiple steps, including the use of decentralized exchanges, cross-chain bridges, and coin swap services. Elliptic and Arkham Intelligence have linked the attack to North Korea's Lazarus Group, which has a history of using such tactics to obfuscate the transaction trail. The group has stolen over $3 billion in crypto assets since 2017, with proceeds reportedly funding North Korea's ballistic missile program.

The stolen funds were initially distributed across 50 different wallets, each holding approximately 10,000 ETH. The attackers then began converting stolen tokens like stETH and cmETH to Ethereum using decentralized exchanges, likely to avoid potential asset freezes. This matches Lazarus Group's typical laundering playbook, as the group often converts stolen tokens to "native" blockchain assets before further obfuscation.

Following the theft, Bybit is facing pressure from user withdrawals, with roughly 23,000 BTC pulled from the exchange's hot wallet. The exchange's main wallets show a Bitcoin balance drop from 70,000 BTC to just over 52,000 BTC, indicating an outflow of roughly $1.7 billion since Friday afternoon. Further analysis suggests Bybit has seen outflows totaling $6 billion across various cryptocurrencies.

Elliptic and others, including ZachXBT, have pointed to anonymous crypto exchange eXch as having processed "tens of millions of dollars" in stolen assets from the hack despite direct requests from Bybit to block the activity. eXch has denied facilitating money laundering, claiming that such allegations are untrue and that the insignificant part of funds processed by them will be donated to various open-source initiatives dedicated to privacy and security both inside and outside the crypto space.