Bybit Hackers Transferred at Least 209,384 ETH, Valued at Approximately $480 Million, onto Bitcoin

MetaMask Head of Security Taylor Monahan confirmed that Bybit hackers transferred at least 209384 ETH, valued at approximately $480 million, onto Bitcoin.

MetaMask Head of Security Taylor Monahan confirmed that Bybit hackers transferred at least 209,384 ETH, valued at approximately $480 million, onto Bitcoin. This accounts for over half of the 400,000 ETH stolen from Bybit, excluding other drained tokens. The movement of funds has complicated efforts to recover them.

Arkham Intelligence reported that at least $240 million of the stolen funds were laundered using THORChain. The stolen crypto was predominantly swapped for Bitcoin. FBI later confirmed that North Korea’s Lazarus Group was responsible for the attack, citing their use of TraderTraitor actors to disperse funds across thousands of blockchain addresses.

Ethereum security experts highlighted that tracking this $1.5 billion hack is particularly challenging due to the thousands of separate transactions that obscure the trail. Pseudonymous researcher SomaXBT noted on X that tracing small portions of the stolen funds is extremely difficult due to the hackers’ sophisticated methods.

Bybit’s CEO, Ben Zhou, assured users their funds remained safe despite withdrawal congestion. The exchange received support from Binance and other crypto entities, which helped retrieve and freeze stolen assets. THORChain blacklisted hacker-linked addresses but could not entirely prevent laundering efforts due to its decentralized nature.

While some stolen funds were recovered, the hackers managed to clean a significant portion, with at least 100,000 ETH ($250 million) laundered. Blockchain analytics firms, including Chainalysis and Elliptic, have been monitoring the fund movements, leading to the freezing of approximately $82.85 million in stolen assets.

Chainalysis confirmed that $40 million had been seized, but reports indicate that the hackers still control a substantial amount of ETH. This amount surpasses the holdings of prominent figures like Ethereum co-founder Vitalik Buterin. The situation remains fluid as authorities and Bybit continue to track and recover stolen funds.

Monahan revealed that the hackers used 3,934 transactions over 115 hours to bridge 161,490 ETH ($370 million) through THORChain. The accounts for most of the ETH converted into Bitcoin. eXch, another bridge used, disabled ETH and ERC-20 swaps, limiting the hackers’ ability to move funds further.

Bybit has offered a 5% bounty to exchanges, bridges, and mixers that help freeze stolen funds and a 10% reward for returning the assets. Despite efforts to curb laundering, ThorChain saw its highest trading volume of $737 million in one day, largely driven by the hackers’ activity.

ThorChain’s native token, RUNE, peaked at $1.60 since the attack but remains below its all-time high of $19.30. Community members criticized ThorChain for failing to prevent laundering, while others argued that its transparency helped track transactions. The situation continues to unfold as authorities work to recover more stolen funds.