77% of Crypto Stolen in $1.4B Heist Still Traceable, Says Bybit CEO

Bybit Hack Update: $1 Billion in Stolen Funds Still Trackable, CEO Warns of Critical Week Ahead

More than 77% of the funds stolen in the massive Bybit hack remain traceable, while roughly 20% have been successfully laundered and are now untrackable, Bybit CEO Ben Zhou said in an update on X early Tuesday.

“The next few days are critical for tracking and freezing these funds as hackers begin cashing out through exchanges, OTC desks, and P2P networks,” Zhou stated, emphasizing the urgency of stopping further laundering.

A total of 417,348 ether (ETH), worth approximately $1 billion, is still visible on the blockchain, despite being routed through the decentralized, privacy-focused THORChain. Meanwhile, about 79,655 ETH (~$200 million) has been fully obfuscated after being processed through ExCH, making further tracking nearly impossible.

Additionally, 40,233 ETH ($100 million) was funneled through OKX’s Web3 proxy, with 23,553 ETH ($65 million) now completely untraceable.

According to Zhou, the hackers have converted 83% of the stolen ETH—around 361,255 ETH (~$900 million)—into Bitcoin using THORChain, distributing the BTC across 6,954 wallets with an average of 1.71 BTC per address.

Blockchain data from DefiLlama shows THORChain handled a record $4.66 billion in swaps in the week ending March 2, generating over $5.5 million in transaction fees, much of it linked to the Bybit exploit.

The breach, attributed to North Korea’s Lazarus Group, was executed by injecting malicious code into SafeWallet, a third-party wallet provider used by Bybit. The attackers reportedly compromised a developer’s device, using it to manipulate a routine wallet transfer and siphon nearly $1.5 billion in ETH.

Despite the scale of the attack, Bybit moved quickly to restore a full 1:1 backing of customer funds, as previously reported by CoinDesk. On-chain data suggests that over $400 million was replenished via OTC trading, with another $300 million sourced directly from exchanges to ensure user balances remained intact.