North Korean Hackers Launder $140 Million in Stolen Bybit Funds, Targeting Ethereum Assets

North Korean hackers are laundering stolen funds from Bybit, with blockchain intelligence firm Elliptic tracking over $140 million in transactions aimed at obscuring the money trail.

North Korean hackers are moving stolen funds from Bybit through a laundering process that has seen over $140 million shifted in transactions designed to conceal the money trail, according to blockchain intelligence firm Elliptic.

The laundering activities follow a major theft on Feb. 23, 2025, which saw $1.46 billion stolen in what is now the largest crypto theft in history.

The recent theft from Bybit on Feb. 23 involved a sophisticated social engineering attack that primarily targeted Ethereum assets. After the breach, the attackers distributed the stolen funds across 50 wallets, each containing around 10,000 ETH, and have begun converting these assets to Bitcoin.

This method of laundering makes it increasingly difficult for authorities to follow the funds, as they are being systematically moved through various anonymous exchanges.

Elliptic reported that the laundering process involves layering the stolen funds to conceal the transaction trail — a tactic designed to buy time for the hackers to cash out the assets.

The firm noted that if previous laundering patterns are followed, the use of mixers may be the next step, although the sheer volume of stolen assets could present challenges in this process.

To date, the Lazarus Group, which has been linked to North Korea, has stolen over $3 billion in crypto since 2017, with the proceeds reportedly used to fund the country’s ballistic missile program.

As a result of the theft, Bybit is experiencing significant user withdrawals, with approximately 23,000 BTC pulled from its hot wallet shortly after the attack.

This has led to a decrease in Bybit’s Bitcoin balance from 70,000 BTC to just over 52,000 BTC, indicating an outflow of around $1.7 billion. Further analysis suggests that total outflows across various cryptocurrencies may amount to $6 billion.

Elliptic and other analysts have highlighted the anonymous crypto exchange eXch as a platform that processed substantial amounts of the stolen assets, despite Bybit’s requests to block such activities.

However, eXch has denied facilitating money laundering for the hackers, claiming that any funds processed were minimal and will be donated to open-source initiatives.

The laundering of stolen Bybit funds underscores the ongoing challenges in monitoring illicit activities within the cryptocurrency space. As hackers continue to adapt their strategies to evade detection, exchanges and users must prioritize robust security measures to protect their assets.