Lazarus Group Has Now Fully Laundered the Proceeds of the Bybit Hack

The North Korean-affiliated Lazarus Group has allegedly fully laundered funds stolen in the recent Bybit hack, transferring 500,000 Ethereum (ETH) primarily into Bitcoin (BTC).

The North Korea-affiliated Lazarus Group has allegedly fully laundered funds stolen in the recent Bybit hack, converting 500,000 Ethereum (ETH) mainly into Bitcoin (BTC). Blockchain security analysts have implicated Lazarus Group as the main suspect behind the attack.

According to data from blockchain security firm Arkham Intelligence, THORChain, a decentralized cross-chain liquidity protocol, has processed over $5.5 billion in transaction volume since the February 21 Bybit hack.

As previously reported by The Shib Magazine, Ben Zhou, Bybit Co-founder and CEO, shared in a post on X that hackers broke into Bybit and stole 1.4 billion in cryptocurrency.

Ben Zhou: 3.4.25 Executive Summary on Hacked Funds: Total hacked funds of USD 1.4bn around 500k ETH, 77% are still traceable, 20% has gone dark, 3% have been frozen.

Breakdown:

- 83% (417,348 ETH, ~$1B) have been converted into BTC with 6,954 wallets (Average 1.71 btc each) This and other data are available on a specially designed website: https://bybit.vc/72777777 to follow the funds.

- 72% (361,255 ETH, ~ $900M) was processed by Thorchain and transactions are still traceable.

- 8% (40,233 ETH, ~ $100M) was moved through OKX Web3 proxy. Out of which 16,680 ETH remains traceable and 23,553 ETH (~$65M or ~5%) is currently untraceable and would require additional data from OKX Web3 Wallet to track.

Eleven entities assisted Bybit in freezing the stolen funds, with Mantle, Paraswap, and ZachXBT playing key roles. A total of $2,178,797 USDT has been distributed to 11 bounty hunters for their contributions.

Bybit has also introduced a tracking website to monitor the movement of its stolen funds and is offering a bounty to those who assist in freezing them.

So far, the platform has identified seven exchanges cooperating in the effort, while one—eXch, a no-KYC swap service—has refused to freeze assets connected to the hack.

Despite surpassing $5 million in revenue, the THORChain protocol has come under scrutiny for its involvement in processing illicit transactions. On February 28, a developer known as “Pluto” resigned after a decision to block transactions linked to North Korean hackers was overturned.

On March 4, crypto commentator Yogi alleged in a post on X that THORChain played a role in laundering $605 million linked to North Korea. “No KYC, no off switch, no resistance. Lazarus Group hacked Bybit for $1.5 billion in February 2025, then funneled the stolen ETH through THORChain like it was built for them. Over five days, $2.91 billion in volume ripped through, $860 million in a single day, while THORChain pocketed $3 million in fees. That’s not innovation—it’s negligence at best, greed at worst,” Yogi wrote.

However, supporters of THORChain argue that, as an open-source and decentralized protocol, it operates independently and does not function as a law enforcement entity. “The only reason why people FEEL that Thorchain should censor transactions is the general FEELING that if they put enough pressure on Node Operators, they will buckle under pressure (which honestly can happen). Nobody is asking that from Bitcoin and Ethereum because it FEELS impossible,” wrote Runemir, Chief Narrative Officer of Qi Capital, in an X post.