Bybit highlights that the bulk of the $1.4 billion stolen capital remains traceable, with a fraction, specifically 3.84%, being frozen for further investigation.

CEO of the cryptocurrency exchange Bybit He provided an insightful summary of the current situation regarding stolen cryptocurrency, revealing how these funds have been transferred and their current distribution.

The findings reveal that about $1.4 billion, equating to nearly 500,000 ETH, has been pinpointed as hacked assets. Out of this total, approximately 68.57% is still trackable, while 27.59% has vanished from sight, and about 3.84% has been successfully frozen. The disappearing funds primarily went through mixers, followed by bridges to P2P and OTC trading systems.

According to Ben Zhou's assessment, Bybit's recent surveillance has pinpointed Wasabi as a key mixer employed by individuals linked with the Democratic People's Republic of Korea. Following its processing, some of these funds were further channeled through privacy-oriented services like CryptoMixer, Tornado Cash, and Railgun.

Following this, the funds were subject to various cross-chain transactions and conversions on decentralized platforms such as Thorchain, eXch, Lombard, LiFi, Stargate, and SunSwap. Ultimately, they ended up on OTC or P2P exchanges, complicating efforts to track their further movement.

Ben Zhou elaborated on the status of $1.2 billion worth of stolen Ethereum and spotlighted the ongoing bounty initiatives, revealing that 5,443 reports have been submitted.

He presented a thorough analysis of the stolen Ethereum’s current flow, underscoring the trajectory and conversion activities of the funds. An estimated 432,748 ETH, which is about 84.45% of the taken assets valued at approximately $1.21 billion, has been shifted from the Ethereum blockchain to Bitcoin utilizing the Thorchain protocol. Out of that figure, around 67.25%, translating to 342,975 ETH (about $960.33 million), has been converted into 10,003 BTC, subsequently decentralized across 35,772 wallets, with an average holding of roughly 0.28 BTC for each one.

On the other hand, only a small fraction of the stolen ETH, approximately 5,991 ETH—or 1.17% of the total, which is about $16.77 million—remains on the Ethereum blockchain. These lingering tokens are distributed across 12,490 wallets, averaging about 0.48 ETH each.

As for the converted Bitcoin, Ben Zhou mentioned that about 944 BTC, which represents 6.34% of the entire stolen amount (around $90.62 million), passed through the Wasabi Mixer, noted for its ability to obscure transaction trails. Additionally, 531 BTC, equivalent to nearly 18,206 ETH or 3.57% of the stolen total, has been moved back to Ethereum via Thorchain.

In the aftermath of the security breach, Bybit has gathered upwards of 5,443 bounty submissions from the crypto community, with 70 of those confirmed as legitimate leads. Ben Zhou He emphasized the platform’s relentless push to amplify contributions from security experts and bounty hunters to assist in tracing the stolen assets and enhancing the security of the platform.

The incident that triggered all of this, which unfolded on February 21st, stands as the most significant security breach recorded in the history of centralized exchanges. The attack This breach has been linked to an advanced malware attack purportedly executed by the Lazarus Group, a notorious cybercrime syndicate connected to the DPRK. This incident resulted in the unauthorized extraction of over $1.5 billion in Ethereum.