Bibit Hackers move stolen funds through crypto mixers and wasabi wallets

Blockchain Analytics Company Elliptic has revealed that the group behind Bybit Hack has launched a laundry fund. In an update to the report on February 23, the company said that the Lazarus Group behind the hack has launched a laundry fund with Bitcoin mixer.

According to Elliptic, Lazarus uses Cryptomixer and Wasabi Wallet to wash stolen funds. The move appears to be the final step in the hacker’s efforts to hide the $1.4 billion stolen traces.

Exchange BTC trading volumes daily after Bybit Hack (Source: Elliptic)

Written:

“Like other North Korea-related thefts, this Bitcoin has begun to go through the mixer and further obfuscate the transaction trail. The process is only just beginning, but hundreds of thousands of dollars worth of stolen assets have already been sent via Cryptomixer and Wasabi wallets.”

While the choice of hacker mixer may surprise most people, it highlights the expertise of North Korean hackers, which Elliptic describes as “the washing machine of the most sophisticated resources that exists.” It also shows how most bad actors can convert stolen assets into Bitcoin as part of the laundry process, and use a variety of methods to make their assets untrackable.

Cryptomixer is a central mixer that has been around since 2016. Like all traditional mixers, users dump their assets into one pool controlled by the operator and use other addresses to withdraw funds excluding fees. It was there for almost a decade, but the platform was able to avoid targeting law enforcement agencies.

On that side, wasabi wallets are not traditional mixed service. In fact, it’s a completely unjust privacy wallet that uses COINJOIN transactions to hide transaction trails. This is not the first time a bad actor has used wasabi. The 2022 Oval Report shows that Chinese spies used it to pay US double agents to pay for bes.

So far, only hundreds of thousands have moved through the mixer, and dozens of crypto investigators have followed the money trail to prevent hackers from cashing out stolen assets despite mixing.

okx frozen Buybit money $43,000

Meanwhile, efforts are underway to recover as much Bibit funds as possible from bad actors as hackers try to convert stolen funds into cash in centralized exchanges.

According to the latest report from On-Chain Thruce ZachxBT, $43,000 connected to the hack is frozen in OKX in collaboration with the OKX team.

While this may seem small given the total stolen amount, it highlights the highly collaborative approach the crypto community has adopted in tracking and recovering stolen funds. Elliptic is busy tracking funds, and Web3 Forensics Company Zeroshadow also helps track and freeze stolen assets.

So far, their efforts have resulted in a freeze of about $50 million in more than 3% of the stolen assets. However, about 20% of the funds ($280 million) have reportedly become untraceable, indicating how effectively hackers are hiding transaction trails.