Bybit CEO: 20% of Stolen Assets Have ‘Gone Dark’

77% of the approximately 500,000 ETH stolen in the Bybit hack remain traceable, 20% have ‘gone dark’, and 3% have been frozen, according to details shared by the exchange’s CEO, Ben Zhou.

3.4.25 Executive Summary on Hacked Funds:
Total hacked funds of USD 1.4bn around 500k ETH, 77% are still traceable, 20% has gone dark, 3% have been frozen.
Breakdown:
— 83% (417,348 ETH, ~$1B) have been converted into BTC with 6,954 wallets (Average 1.71 btc each) . This and…

— Ben Zhou (@benbybit) March 4, 2025

417,348 ETH, (~$1 billion) or 83% of the total, were converted by the perpetrators into bitcoins using 6,954 wallets (averaging 1.71 BTC each).

The current and following weeks are critical for freezing funds, as the coins will begin to be ‘cleaned’ on exchanges, OTC and P2P platforms, emphasized the Bybit CEO.

The hackers primarily used THORChain to exchange Ethereum for bitcoin.

361,255 ETH or $0.9 billion, accounting for 72% of the losses, passed through a cross-chain protocol that Bybit is able to monitor.

79,655 ETH (~16% of the funds) were routed through a DEX called ExCH.

40,233 ETH or $100M (~8% of the losses) were directed by the hackers through the OKX Web3 Wallet proxy.

16,680 ETH of this amount can be tracked by the exchange’s analysts. Information on 23,553 ETH or $65 million (~5% of the assets) is unavailable, requiring the involvement of specialists from the mentioned wallet.

Zhou also provided an update on the bounty program.

According to him, 11 participants helped freeze part of the funds. The top manager highlighted the teams Mantle and ParaSwap, as well as on-chain analyst ZachXBT. Payments amounted to $2.18 million in USDT.

Earlier, the FBI confirmed the involvement of the North Korean group TraderTraitor (also known as Lazarus Group, APT38, BlueNoroff, and Stardust Chollima) in the Bybit hack.

Previously, cypherpunk Adam Back cited the ‘flawed EVM design’ as the reason for the exchange’s breach.

Later, Sygnia analysts reported that the incident occurred due to a vulnerability in the Safe infrastructure. Binance founder Changpeng Zhao criticized the wallet developer’s report on the Bybit hack.