Bybit Hackers Laundering Funds using eXch

BeosinTrace tracked the @Bybit_Official hacker transferring assets again at 08:58:23. The new address 0x83c7678492d623fb98834f0fbcb2e7b7f5af8950 began transferring assets on February 24, 2025, at 08:58:23.

Last Friday, the world witnessed one of the largest crypto heists in history, with Bybit losing around $1.5 billion in an attack attributed to the notorious North Korean hacking group, Lazarus. Now, a recent report suggests that the hacker behind the Bybit attack is laundering stolen funds through the cryptocurrency exchange eXch.

This revelation comes despite eXch’s previous denial of any involvement in money laundering. On February 23, the exchange released a statement claiming, “We are not laundering money for Lazarus/DPRK,” and assured users that all funds were safe and operations were unaffected by the Bybit hack.

However, Web3 security firm BeosinTrace tracked the Bybit hacker making another transfer of stolen assets at 08:58:23 UTC+8 today. According to BeosinTrace, the method of laundering funds has become more consistent, mainly using Thorchain to transfer assets to the BTC blockchain, then converting the funds into DAI via the OKX decentralized exchange (DEX). These converted DAI tokens are then sent to eXch.

On February 23, at 21:37:23 UTC, BeosinTrace identified a transaction from the hacker’s address, linked to the Bybit attack (0xfc926659dd8808f6e3e0a8d61b20b871f3fa6465), which was detected sending funds to settlement addresses and routed through Thorchain:Router.

Today, BeosinTrace reports that the hacker’s asset transfer was completed at 04:00:02 UTC on February 24, 2025, with the same address, 0xfc926659dd8808f6e3e0a8d61b20b871f3fa6465, being used. The asset laundering process continues to stabilize, with the funds being routed through Thorchain to the BTC chain and then exchanged for DAI on OKX DEX, before flowing into eXch.