The Lazarus Group Has Already Laundered All the Bybit Funds It Stole

ArkhaM Intelligence, the blockchain analytics platform, revealed a new development in the recent Bybit hack. The firm posted a bounty for information about the incident, discovering that the Lazarus Group was responsible.

The Lazarus Group has already laundered all of the unfrozen funds it stole from the recent Bybit hack, according to Arkham Intelligence. The group used THORChain’s DEX to convert ETH tokens, sparking community criticisms. Some users blamed THORChain validators for negligence, claiming that they could’ve stopped the transactions. Others defended the platform, claiming it’s an open-source and decentralized organization, not a law enforcement agency.

Earlier today, Arkham discovered that the recent Bybit hack was carried out by the infamous Lazarus Group, a North Korean state-sponsored cybercriminal collective. The firm posted a bounty for information about the incident. Afterward, it began releasing updates about the hack, confirming that all the funds from the Bybit hack have been successfully laundered.

“Lazarus has now fully laundered the proceeds of the Bybit hack. They have transferred 500,000 ETH mainly to native BTC. Thorchain has processed over $5.5 billion in volume since Bybit was hacked on the 21st of February,” Arkham claimed via social media.

The Bybit hack was the largest crime in crypto history, stealing $1.5 billion in Ethereum tokens. Two days ago, analysts confirmed that Lazarus had already laundered 70% of the stolen Bybit funds.

Yesterday, Bybit CEO Ben Zhou noted that 83% had been converted to Bitcoin, and now the entire supply has been processed.

Bybit CEO Zhou also claimed that Lazarus laundered 72% of Bybit’s assets through THORChain, a decentralized exchange/blockchain network. The vast majority of transactions converting ETH to BTC went through this exchange.

Also, THORChain’s 24-hour trading volume spiked due to the sheer size of these transactions, surpassing several much more prominent networks.

Already, a few people have begun blaming THORChain for the debacle. As one user pointed out, the Lazarus Group laundered huge quantities of Bybit’s money, and the exchange did nothing to stop them. It actually collected $3 million in fees from the affair.

Still, THORChain defenders have pointed out that it is open-source and decentralized, not a law enforcement agency.

“The only reason why people feel that THORChain should censor transactions is the general feeling that if they put enough pressure on Node Operators, they will buckle under pressure (which honestly can happen). Nobody is asking that from Bitcoin and Ethereum, because it feels impossible. Thorchain needs to win the battle of narratives,” said Runemir, Chief Narrative Officer at Qi Capital.

In short, the whole affair is very messy. Taking the pro-THORChain arguments at face value, then decentralized institutions are structurally vulnerable to facilitating massive finance crimes. If Lazarus Group can successfully use these platforms to launder billions, that’s simply the cost of doing business. It’s hardly an appealing picture of decentralized finance as an economic model.

On the other hand, the loudest criticisms also leave something to be desired. THORChain’s RUNE token briefly spiked due to these high trade volumes, but the gains have already disappeared. The firm’s involvement with Bybit laundering will likely follow its reputation for years, and this won’t do it any favors. If THORChain validators were acting in self-interest, it was a shortsighted move.

In any event, it’s impossible to track down clean motivations for everyone involved in this story. The Lazarus Group laundered a huge amount of funds from the Bybit hack, and there’s a lot of blame to go around.