Bybit Hack Update: North Korean Lazarus Group Used Wasabi Mixer to Launder $100 Million in Bitcoin

Hackers behind the $1.5 billion Bybit cryptocurrency theft have started laundering stolen bitcoins through mixing services and peer-to-peer (P2P) vendors.

The hackers behind the $1.5 billion Bybit (뱌이빗) hack have started laundering the stolen bitcoin through mixing services and peer-to-peer (P2P) vendors, reports suggest.

According to a post by Bybit CEO Ben Zhou, 193 BTC, valued at $16 million, were funneled through the Wasabi mixer before being distributed across various P2P networks.

The heist, which took place in February, saw hackers steal a staggering amount of cryptocurrency from the exchange, with the majority of the stolen funds being in bitcoin.

The hackers exchanged 86 of the stolen funds for ether to Bitcoin.

The amount of 440,091 ETH, which is equivalent to approximately $1.23 billion, was swapped for 12,836 BTC.

The received Bitcoin was then divided into 9,117 wallets, with an average balance per wallet of 1.41 BTC.

Cross-chain liquidity protocols such as THORChain have been identified as the principal means through which the conversion occurred.

This method allows users to interchange assets between different blockchains without dealing with centralized exchanges.

However, the conversion process began with the hackers transferring the stolen ether to a new wallet, where they used it to purchase BTC via the cross-chain protocol.

Afterward, they used mixers to try and obscure the movements of the funds.

While the hackers are suspected to be from the North Korean Lazarus Group, they have been trying to wash the stolen Bitcoin through several mixers.

Some of the presently available mixers are Wasabi, CryptoMixer, Railgun, and Tornado Cash. The main purpose of using a mixer is to hide the history of the transactions to ensure that the traces cannot be followed.

“Decoding mixer transactions is the problem which is on the top of the list,” said Bybit CEO Ben Zhou for X.

He further noted that the laundering activity will continue to rise with more funds being channeled through these services.

Wasabi is a Bitcoin mixing service that introduced the CoinJoin technique which combines several transactions into one to increase anonymity.

This way, blockchain investigators are unable to easily trace movements of funds by an individual.

After passing through mixers, the stolen Bitcoin is being sent to P2P vendors. These vendors facilitate direct transactions between individuals without requiring intermediaries.

Since P2P trading often bypasses centralized oversight, it adds another layer of complexity to tracking and recovering stolen assets.

According to Bybit, 88.8% of the stolen funds remain traceable, while 7.6% have become untraceable due to laundering efforts. Additionally, 3.5% of the funds have been successfully frozen through cooperation with industry partners.

Following the hack, the exchange launched a bounty program to incentivize individuals and organizations to help trace and freeze the stolen assets.

The program has allocated a total of $140 million in rewards, with $2.2 million already awarded.

The bounty is structured to provide 10% of any recovered funds, with half going to the entity that successfully freezes them and the other half to the first reporters who contribute to the freezing process.

In the past 30 days, Bybit received 5,012 bounty reports, of which 63 were deemed valid.

Bybit CEO Ben Zhou highlighted the need for more experts who can analyze mixer transactions and track stolen funds.

"We need more experts to help decode mixer transactions & track stolen funds. Join the Bybit Bounty Program today & contribute to the recovery effort!" he said.

Data from Arkham Intelligence suggests that the Lazarus Group currently holds 13,400 BTC, much of which is linked to the Bybit hack.

Investigators are continuing to monitor these assets while working with exchanges and blockchain analytics firms to prevent further laundering.