North Korea's Lazarus Group Laundered All $1.39 Billion Stolen from Bybit Through THORChain in Just 10 Days

According to a Mar. 4 post on X by on-chain analyst EmberCN, who has been tracking the stolen funds, much of the Ethereum (ETH) was funneled through THORChain (RUNE)

North Korea's Lazarus Group is said to have laundered all of the 499,000 ETH, roughly $1.39 billion, stolen from the Bybit hack in just 10 days.

According to a March 4 post on X by on-chain analyst EmberCN, who has been tracking the stolen funds, much of the Ethereum (ETH) was funneled through THORChain (RUNE), a decentralized cross-chain liquidity protocol, and converted into Bitcoin (BTC).

The hacker has finished laundering all the 499k ETH stolen from Bybit, which took 10 days and saw a 23% decline in the ETH price (from $2,780 to $2,130). The main channel used for money laundering was THORChain, which handled $59 billion in transactions and collected $5.5 million in fees. Sponsored by #Bitget.

According to the post, the hackers were able to launder the stolen ETH quickly and efficiently, despite efforts by other protocols to halt the movement of the funds. One critic on X referred to THORChain's response as "negligence at best, greed at worst."

While other protocols acted accordingly to stop the movement of the stolen funds, the THORChain validators did not take any meaningful action. Pluto, a core contributor, resigned in protest after a governance proposal to halt ETH transactions was rejected.

Meanwhile, Bybit CEO Ben Zhou has since provided an update on the movement of the stolen assets. In a March 4 post on X, he revealed that 77% of the stolen funds remain traceable, while 20% have gone dark, and 3% have been frozen.

This and 3% of the funds have been frozen. We are still working hard to recover more of the stolen assets and provide assistance to affected users. We will keep everyone updated on any significant developments.

According to Zhou, 83% of the laundered funds were converted into Bitcoin, distributed across 6,954 wallets, with 72% (⁠$900 million) of these funds passing through THORChain.

Moreover, after being transferred through ExCH, 16% of the assets became untraceable, and the OKX Web3 Proxy processed another 8% (⁠$100 million).

Bybit has since launched Lazarusbounty.com, a fund-tracking website, and it is providing bounties to exchanges that help recover the stolen assets.

So far, $2.17 million in rewards have been paid to 11 bounty hunters, with Mantle, Paraswap, and ZachXBT among the top contributors.