Bybit Founder: 88% of Stolen Assets are Still Traceable

As you may have noticed, the large crypto exchange Bybit was hit by an unprecedented hack at the end of February 2025, where cybercriminals, presumably linked to North Korea, made off with $1.4 billion in digital assets – equivalent to about 401,000 ETH. Nearly three weeks later, on March 20, founder and CEO Ben Zhou published a detailed analysis on X about the attack and Bybit’s response. His report provides insight into the techniques of the perpetrators and the challenges of recovering the stolen funds, while calling on the crypto community to help.

A Maze of Mixers

Zhou revealed that the attackers – presumably the North Korean Lazarus Group, according to Chainalysis – used anonymity tools such as Wasabi, Cryptomixer, Railgun, and Tornado Cash to erase their tracks. Despite these efforts, 88.87% of the funds remain traceable on the blockchain, while 7.59% have become “invisible” and 3.54% ($49.5 million) have been seized by authorities. A notable detail: 86.29% of the loot – about $1.2 billion – was converted into 12,836 BTC, scattered across 9,117 wallets. Of this, 193 BTC was laundered through Wasabi Mixer and forwarded to P2P trading platforms. However, Zhou also asked the community for help:

“Cracking mixer transactions is our biggest challenge. If you can help, please get in touch.”

He emphasized how these tools, which promise privacy, are a nightmare for investigators. The hack, carried out on February 21 by exploiting a vulnerability in Bybit’s Safe{Wallet} system, marks the largest crypto theft ever – larger than Ronin ($625 million) or Poly Network ($611 million).

Bounty Program and Response

Bybit’s recovery efforts are in full swing. Zhou reported that the bounty program, which promises 10% of recovered funds (up to $140 million), received 5,012 submissions – but only 63 met the strict criteria. “We need more hunters who can dissect mixers,” he said. Collaboration with blockchain experts such as Chainalysis and TRM Labs has already yielded results: 88% of the stolen ETH ($1.23 billion) was replaced through loans and whale deposits, and a Hacken audit confirmed that Bybit’s reserves are again 100% covered.

The attack began when hackers hacked a Safe{Wallet} developer, masked a malicious transaction, and plundered Bybit’s ETH cold wallet. Within 12 hours, Bybit restored withdrawals, backed by $172.5 million in loans from Bitget and Binance. Zhou’s transparency – addressing the community within 30 minutes of the hack – kept panic at bay, despite $4 billion in outflows.

“This is a war against Lazarus,” he said earlier on X, referring to the group behind previous mega thefts. He insists on more analysts: “Collaboration is crucial to stop crypto theft.” However, for users, it’s a reminder: hardware wallets and caution are key. The hunt for $1.4 billion continues – and the crypto world is watching.