North Korea’s Lazarus Group has reportedly laundered all the 499,000 ETH, roughly $1.39 billion, stolen from the Bybit hack in just 10 days.
According to a Mar. 4 post on X by on-chain analyst EmberCN, who has been tracking the stolen funds, much of the Ethereum (ETH) was funneled through THORChain (RUNE), a decentralized cross-chain liquidity protocol, and converted into Bitcoin (BTC).
THORChain has handled $605 million in transactions in the last 24 hours alone. The platform has received criticism for its involvement in facilitating illegal transactions, after recording $5.9 billion in volume and collecting $5.5 million in fees during the laundering process.
One critic on X referred to THORChain’s response as “negligence at best, greed at worst.” While other protocols acted accordingly to stop the movement of stolen funds, THORChain validators did not take any meaningful action. Pluto, a core contributor, resigned in protest after a governance proposal to halt ETH transactions was rejected.
Meanwhile, Bybit CEO Ben Zhou has since provided an update on the movement of the stolen assets. In a Mar. 4 post on X, he revealed that 77% of the stolen funds remain traceable, while 20% have gone dark, and 3% have been frozen.
According to Zhou, 83% of the laundered funds were converted into Bitcoin, distributed across 6,954 wallets, with 72% ($900 million) of these funds passing through THORChain. Moreover, after being transferred through ExCH, 16% of the assets became untraceable, and the OKX Web3 Proxy processed another 8% ($100 million).
Bybit has since launched Lazarusbounty.com, a fund-tracking website, and it is providing bounties to exchanges that help recover the stolen assets. So far, $2.17 million in rewards have been paid to 11 bounty hunters, with Mantle, Paraswap, and ZachXBT among the top contributors.
