Cryptocurrency exchange Bybit's CEO Ben Zhou said that 27.95% of the funds lost in the $1.4 billion exploit engineered by the North Korean Lazarus Group have gone dark or become untraceable.

input: Cryptocurrency exchange Bybit's CEO Ben Zhou said that 27.95% of the funds lost in the $1.4 billion exploit engineered by the North Korean Lazarus Group have gone dark or become untraceable.

The North Korean Lazarus Group's exploit on cryptocurrency exchange Bybit has seen 27.95% of the funds lost go dark or become untraceable, according to an executive summary by Bybit CEO Ben Zhou.

"Total hacked funds of USD 1.4bn around 500k ETH. 68.57% remain traceable, 27.59% have gone dark, 3.84% have been frozen. The untraceable funds primarily flowed into mixers then through bridges to P2P and OTC platforms," Zhou said in the summary published on X on Monday.

The untraceable funds were moved into mixers before being transferred through bridges to P2P (peer-to-peer) and OTC (over-the-counter) platforms, the post explained, mentioning the use of Wasabi, a crypto mixer, to wash off a certain amount of BTC, following which a portion of these funds entered into other mixers, including Railgun, Tornado Cash and CryptoMixer.

The malicious entity then executed multiple cross-chain swaps through Thorchain, eXch, Lombard, LiFi, Stargate and SunSwap, with the final stage involving the conversion of these illicit funds into more liquid assets.

The Lazarus Group, linked to North Korea, hacked Bybit in February, draining 500,000 ether (ETH) by taking "control of the specific ETH cold wallet and transferring all the ETH in the cold wallet to this unidentified address."

According to the summary, Lazarus Group's exploit on cryptocurrency exchange Bybit has seen 27.95% of the funds lost go dark or become untraceable.

The post explained that the untraceable funds were moved into mixers before being transferred through bridges to P2P (peer-to-peer) and OTC (over-the-counter) platforms.

It added that Wasabi was used to wash off a certain amount of BTC, following which a portion of these funds entered into other mixers, including Railgun, Tornado Cash and CryptoMixer.

The malicious entity then executed multiple cross-chain swaps through Thorchain, eXch, Lombard, LiFi, Stargate and SunSwap, with the final stage involving the conversion of these illicit funds into more liquid assets.

The Lazarus Group, linked to North Korea, hacked Bybit in February, draining 500,000 ether (ETH) by taking "control of the specific ETH cold wallet and transferring all the ETH in the cold wallet to this unidentified address."

After the exploit, Bybit launched the Lazarus Bounty initiative to encourage whitehat hackers to help in tracing the stolen cryptocurrency.

The exchange's CEO Ben Zhou said that the initiative has received 5,443 bounty reports in two months, out of which, 70 have been deemed valid.

"We need more bounty hunters that can decode mixers as we need a lot of help there down the road," Zhou added.

According to the summary, a total of 432,748 ETH, representing 84.45% of the hacked funds, has been transferred from ether to bitcoin via Thorchain.

Notably, 67.25% of these funds, amounting to 342,975 ETH (around $960.33 million), has been converted into 10,003 BTC and distributed across 35,772 wallets with an average of 0.28 BTC per wallet.

Further, 1.17% of the funds, or 5,991 ETH (approximately $16.77 million), remains on the Ethereum blockchain, stashed across 12,490 wallets.

Lastly, the Lazarus Bounty initiative has received 5,443 bounty reports in two months, of which, 70 have been deemed valid. Zhou said the exchange needs "more bounty hunters that can decode mixers as we need a lot of help there down the road."