Bybit Hackers Still Haven't Gone Cold, $1.4B in Stolen Crypto Tracked Across Chains

The $1.4 billion Bybit hack, one of the largest digital heists to date, is still unfolding, and the trail hasn't gone cold just yet.

Key Takeaways

* The $1.4 billion Bybit hack, one of the largest digital heists to date, is still unfolding, and the trail hasn’t gone cold just yet.

* Despite increasingly sophisticated laundering techniques, blockchain forensic teams are actively tracking billions in stolen crypto as it moves through mixers, bridges, and decentralized networks.

* A large portion of the hacked funds are now being funnelled through Wasabi Mixer, a service known to be used by DPRK-linked groups.

* Bybit co-founder and CEO Ben Zhou is urging community members to join the Lazarus Bounty program and report any leads on the stolen funds.

One of the largest cryptocurrency hacks to date is still unfolding, and the trail hasn't gone cold just yet.

In April, Bybit co-founder and CEO Ben Zhou provided an update on the $1.4 billion hack, which saw roughly 500,000 ETH stolen.

According to Zhou, about 68.57% of the stolen cryptocurrency is still traceable, 28% has gone dark, and just 3.8% has been frozen.

Of the original 500,000 ETH, a massive 432,748 ETH (∼$1.21 billion, or 84.45%) was bridged to Bitcoin via Thorchain.

Of that amount, 342,975 ETH was converted into 10,003 BTC and scattered across 35,772 wallets, averaging just 0.28 BTC per wallet.

This suggests a deliberate effort to fragment and mask the funds further.

Only 1.2% of the original ETH remains on Ethereum (ETH). Meanwhile, 944 BTC was processed through Wasabi, with a small portion later bridged back to Ethereum via Thorchain.

In response, the Lazarus Bounty platform has received 5,443 reports in the past 60 days, 70 of which have been confirmed as valid.

"We welcome more reports," said Zhou. "We need more bounty hunters who can decode mixer activity—we need a lot of help down the road."

However, some community members expressed skepticism about the platform's security and the accuracy of its figures.

“Transparency appreciated, Ben. But I’ve got one question,” said Kevin Ang on X.

“Out of 5,443 bounty reports, only 70 were valid? That level of precision doesn’t sound like crowdsourced discovery—it sounds like insiders already knew what to look for. Were those 70 bounty hunters public contributors, or were they white-hats already close to the fire? Because to outsiders, this feels less like a hunt and more like a post-exploit sanitization operation.”

Another user echoed the sentiment: “It’s very odd that we identify no one after stealing this much. We need to crack down and press legal charges; otherwise, it’s become quite normal.”