Features writer

Jeffrey Gogo

Features writer

Jeffrey Gogo

About Author

Jeffrey Gogo is a journalist with 20 years of experience in business, finance, cryptocurrency, and climate change news and analysis.

Share

Last updated: 

September 15, 2025

Key Takeaways:

• Vitalik Buterin tested Hinkal’s “Invisible Wallet,” a new tool that hides wallet activity to protect users from hacks.
• Crypto hacks surged to $163 million in August, rising for the third month a row.
• Analysts say privacy wallets can reduce exposure for high-net-worth holders, but warn they’re not a silver bullet against determined tracking.
• While zero-knowledge proofs allow for privacy-preserving compliance, experts say legal alignment remains uncertain.

Ethereum cofounder Vitalik Buterin has been testing Hinkal’s new ‘Invisible Wallet,’ a privacy tool that could mark a breakthrough at a time when wealthy wallets are increasingly targeted by hackers.

It comes as losses from crypto hacks soared to $163 million in August, rising for the third month in a row, according to PeckShield. In the last five years alone, crypto investors have lost over $4 billion in targeted attacks.

Web3 firm Hinkal says its wallet allows users to hide their on-chain activity. It claims that users, especially those with big balances, can use the wallet to deter attacks without compromising regulatory compliance.

Hinkal CEO Giorgi Koreli described crypto’s in-built transparency as a “bug”. He says it is not “normal” that over $4 trillion in crypto assets on public blockchains “can be monitored and potentially weaponized by others.”

“Privacy-preserving wallets are the future, because free surveillance and tracking can’t be,” Koreli argues.

In his test transfer in late August, Buterin sent 0.01 ETH ($44) from his wallet to an address owned by Hinkal using its invisible wallet, according to Etherscan data. Buterin’s wallet address is publicly labeled vitalik.eth.

As seen in the image below, Hinkal kept track of the Ethereum founder’s activity but did not share any more of his internal transactions for privacy reasons. Even his well-known address is obfuscated in the transaction record.

“If your assets can be watched, your transaction can be mapped and traced at every interaction,” Koreli wrote in an article posted on X. “It’s not freedom. It’s additional exposure.”

Hinkal’s Invisible Wallet ‘Is Not a Silver Bullet’

The blockchain is, by design, a public ledger that broadcasts wallet activity. As Koreli puts it, every transaction, position, and trading strategy is visible to competitors, as well as cybercriminals.

He says crypto’s “radical transparency” has been a major obstacle, discouraging privacy-focused institutions in traditional finance from investing in the “$50 billion” decentralized finance (DeFi) market.

Slava Demchuk, CEO of blockchain analytics firm AMLBot, said tools like Hinkal’s invisible wallet can raise the bar for personal security by shielding wallet balances and transaction histories from opportunistic attackers.

“For high-net-worth holders, that additional layer of privacy reduces the risk of targeted hacks, phishing attempts, or even physical threats,” Demchuk told Cryptonews, adding:

“Of course, as with any system, ultimate protection depends on adoption, decentralization, robustness of the cryptography behind it, and, most importantly, on users’ own caution.”

Invisible wallets, like Hinkal’s, act as cloaking devices. Transactions can still be validated on-chain, but sensitive details, such as wallet addresses, amounts, or counterparties, remain hidden from public scrutiny, experts say.

Yury Serov, head of investigations at analytics firm Global Ledger, lauded the privacy wallet for removing the most obvious exposure points, namely the appearance of a public address in swaps, lending and routine DeFi use.

But this “invisible” must not be conflated with “invulnerable.” For example, he says, if someone moves unusually large amounts when the liquidity pool is thin, bad actors may easily correlate deposits and withdrawals.

“Timing patterns, transaction sizes, and even metadata from relayers can give away more than users expect,” Serov tells Cryptonews, adding:

“In practice, this means Hinkal makes it much harder for casual observers or opportunistic attackers to track big wallets, but it won’t make a whale completely disappear from a determined investigation.”

According to Serov, Hinkal’s Invisible Wallet “is best viewed as a layer of risk reduction, not a silver bullet.”

Can Privacy and Compliance Coexist?

Hinkal insists that its wallet can be both private and compliant at the same time. Experts aren’t so sure. According to AMLBot CEO Demchuk, it is technically feasible for the wallet to comply with the rules while private.

“Yes, users do pass KYC requirements, and zero-knowledge (ZK) proofs allow them to demonstrate eligibility without exposing personal data,” he noted. “However, from a legal standpoint, it’s not entirely compliant yet.”

Under the European Union’s General Data Protection Regulation, or GDPR, service providers may still be required to act as data controllers, creating “a gap between technical compliance and regulatory obligations,” he said.

The blockchain analyst brought up PureFi as an alternative framework that verifies compliance checks on-chain while ensuring that service providers retain the role of data controller.

“So, while Hinkal’s approach is innovative, there are still open questions about full regulatory alignment,” said Demchuk.

Global Ledger’s Serov concurred with Demchuk, saying that with ZK proofs, users can prove they have already passed (know your customer) KYC verification with a regulated exchange or that they are not on the sanctions list, to participate.

He explains:

“Historically, regulators and policymakers have sometimes seen privacy as being in direct opposition to financial crime compliance. But today, technological advances are moving so quickly that it may no longer be necessary to sacrifice one goal to achieve the other.”

But not everyone is entirely convinced. Didier Lavallée, CEO of Canadian crypto firm Tetra Trust, says Hinkal’s compliance model is “unclear”.

“You would need some kind of token or verification system to confirm it is compliant,” Lavallée told Cryptonews. Still, the service might be useful for institutions that continue to use permissioned blockchains, he said.

Vitalik Wants Privacy Wired Into the Blockchain

Vitalik Buterin has occasionally revisited the question of privacy in his blogs. He usually breaks down the “moon math” that is required to code privacy protocols such as zero-knowledge proofs into Ethereum.

His simple solution is to wire privacy into the blockchain itself rather than add it on top of the blockchain in the form of a wallet, for example.

“Up until now, making private transfers on Ethereum has required users to explicitly download and use a ‘privacy wallet’, such as Railway (or Umbra for stealth addresses),” Buterin explains in one blog entry.

“This adds great inconvenience and reduces the number of people who are willing to make private transfers. The solution is that private transfers need to be integrated directly into wallets.”

One of his proposed implementations would have wallets store a portion of a user’s assets as a “private balance” in a privacy pool.

“When a user makes a transfer, it would automatically withdraw from the privacy pool first,” says Buterin. “If a user needs to receive funds, the wallet could automatically generate a stealth address.”

Invisible Wallet: Transparency vs. Privacy

Hinkal’s privacy tool challenges crypto’s core ethos of transparency. After all, blockchain was built to let “everyone see everything.” However, some crypto analysts argue the wallet reframes crypto transparency rather than ends it.

“Instead of putting every detail of a user’s balance and trades on-chain, it uses zero-knowledge proofs to make only the necessary facts verifiable,” said Serov, the Global Ledger head of investigations, adding:

“In other words, it tries to preserve the trustless auditability of crypto while reducing the personal exposure that comes with full transparency. Hinkal reflects a shift from ‘everyone sees everything’ to ‘everyone can verify what matters.’”

AMLBot’s Demchuk spoke about balancing transparency with privacy. “Transparency has always been core to blockchain, but privacy is equally fundamental, especially when financial security is at stake,” he detailed.

“Public ledgers can remain auditable, while individual users gain choice over what information they reveal.”

Meanwhile, Hinkal could face much bigger problems. Privacy tools have historically drawn sharp reactions from regulators.

In 2022, for example, the U.S. Treasury Department sanctioned Ethereum-based mixing service Tornado Cash on allegations of facilitating billions in laundered funds. Its cofounder, Roman Storm, was indicted in the U.S. for money laundering.

“There are some legitimate use cases of the (Hinkal) app, like payroll or protection from dusting attacks,” Serov noted. “But this innovation is likely to attract regulators’ attention in advanced regulatory regimes, like the EU.”

Without a MiCA license, or Markets in Crypto Assets Regulation, Hinkal will not be able to offer its privacy-enhanced crypto custody solution in the European Union, according to Serov.

“Under the new AMLR, crypto asset services providers will not be allowed to facilitate transactions with privacy coins or anonymous accounts from July 2027. Such privacy-enhancing solutions will be effectively outlawed.”

Analysts say Hinkal’s wallet will likely be pushed out into jurisdictions that don’t yet have similar regulations in place.

“Unlike mixers, which anonymize flows without checks, Hinkal integrates privacy-preserving KYC and access tokens,” said Demchuk. “That gives regulators a framework to distinguish it from ‘black box’ laundering tools.”

Data from Global Ledger shows that Tornado Cash received roughly $1.5 billion worth of ETH between Jan. 1 and Sept. 5 this year (see image above).

Serov said around 36% of the funds are “high-risk” and come from hacks, such as the Cork Protocol hack and Bybit hack, as well as sanctioned entities like Garantex and other risky sources. “The mixer poses significant AML risks,” he added.

Minting NFTs on Ethereum has become synonymous with creativity—and high costs. As the network’s popularity has surged, so have its gas fees, sometimes making it prohibitively expensive for independent artists, small studios, or developers testing new projects. But that’s changing.

Thanks to the evolution of Layer 2 solutions, smarter smart contract standards, and growing platform support for gas-saving features, creators in 2025 now have a toolkit to reduce Ethereum gas fees. Whether you’re launching a 10,000-piece collection or a one-off art drop, these advanced techniques will help you mint more efficiently, strategically, and affordably.

Here are seven battle-tested gas hacks to optimize your NFT minting on Ethereum.

Key Takeaways

• Layer 2 networks, such as Polygon and Arbitrum, offer near-zero gas fees for NFT minting.

• Batch minting using standards like ERC721A can cut costs by over 80%.

• Lazy minting defers fees to buyers, saving upfront gas.

• Off-peak scheduling reduces Ethereum gas fees by up to 60%.

• Smart contract optimization directly lowers minting transaction costs.

What Are Ethereum Gas Fees?

Gas fees are payments made to Ethereum validators for processing transactions. These fees, denominated in Gwei, vary depending on network congestion. Minting an NFT, which triggers smart contract execution, can cost anywhere from a few dollars to hundreds — making efficiency crucial for creators.

1. Use Layer 2 Solutions

Ethereum’s congestion has driven gas fees sky-high, but Layer 2 (L2) solutions offer an elegant fix. Networks like Polygon, zkSync, Arbitrum, and Optimism offload transaction execution and settle on the Ethereum mainnet in batches. This reduces gas costs dramatically—often to fractions of a cent.

To begin:

• Bridge ETH to your chosen L2 using tools like the Arbitrum Bridge or zkSync Portal.

• Connect your wallet to the new network.

• Mint your NFTs on supported platforms like OpenSea (Polygon), Immutable X, or Zora.

Pros

Cons

2. Batch Minting with ERC721A or ERC1155

Minting NFTs one by one is inefficient. Standards like ERC721A and ERC1155 allow you to batch mint NFTs, compressing multiple mints into a single transaction—a game-changer for cost savings.

Here’s how to use it:

• Use a minting platform like Manifold Studio, or deploy a custom contract that supports ERC721A.

• Upload your metadata and assets.

• Mint in bulk using built-in batch functions.

This is one of the most effective methods for reducing Ethereum gas fees in high-volume projects.

Pros

Cons

Azuki cut collector gas costs by over 60% using ERC721A.

3. Lazy Minting (Mint-on-Demand)

With lazy minting NFTs, creators upload content off-chain and defer blockchain confirmation until the asset is purchased. This means you avoid paying gas unless there’s a sale.

How it works:

• Choose a platform like OpenSea, Rarible, or Mintable.

• Upload your NFT metadata—the file remains off-chain until sold.

• When someone buys it, the NFT is minted and logged on-chain.

Pros

Cons

4. Time Your Mints During Off-Peak Hours

Gas prices fluctuate wildly throughout the day. By timing your mint during low network activity, you can significantly reduce costs—sometimes by 60% or more.

To optimize timing:

• Use trackers like Etherscan Gas Tracker or Blocknative’s estimator

• Identify low-traffic windows (typically 1–6 AM UTC or weekends)

• Plan your drops or contract interactions accordingly

Pros

Cons

5. Optimize Smart Contract Code

Well-written smart contracts don’t just perform better—they cost less. By minimizing expensive operations, you reduce the amount of gas required for minting and other interactions.

To get started:

• Use libraries like OpenZeppelin, which offer gas-efficient contract templates

• Run audits with tools such as Slither or MythX

• Avoid storage-heavy loops and unoptimized logic

This is a long-term investment that helps consistently reduce Ethereum gas fees for both creators and collectors interacting with your contracts.

Pros

Cons

6. Set Custom Gas Prices and Limits

Most wallets allow you to adjust gas settings manually. During low congestion, lowering the Gwei price can result in meaningful savings without sacrificing reliability.

Here’s how:

• In MetaMask or Rabby, click “Edit” before confirming a transaction

• Choose “Low” or enter a custom Gwei value (e.g., 8 Gwei during quiet times)

• Confirm the transaction and monitor its progress

Pros

Cons

7. Use Gas Abstraction Tools or Gasless Minting

Gas abstraction shifts the gas payment from the user to a third-party relayer. Some platforms even subsidize these fees as part of promotional campaigns or UX design.

To try it:

• Sign up with platforms like Mintology, Biconomy, or Gelato

• Create your NFT and authorize a transaction—no ETH needed

• A relayer processes the minting on-chain, sometimes absorbing the cost entirely

Pros

Cons

Risks to Consider

While these hacks can drastically reduce gas fees, they’re not without trade-offs:

• Off-chain or abstracted transactions may depend on third-party uptime and integrity

• Lazy minting delays on-chain provenance

• Optimized contracts require upfront dev work or audit costs

Bonus: Consider Cheaper Blockchains

Ethereum isn’t the only game in town. Chains like Polygon, Tezos, and Solana offer minting for pennies or less—ideal for large or experimental projects.

Cross-chain platforms like OpenSea and Magic Eden now support multi-network minting, allowing you to maintain reach while dramatically reducing cost.

Conclusion

Ethereum gas fees remain one of the biggest hurdles for NFT creators—but they don’t have to be. As the Ethereum ecosystem evolves, the tools to reduce Ethereum gas fees are becoming increasingly powerful, accessible, and creator-friendly.

From leveraging Layer 2s and batch minting NFTs to strategic timing and lazy minting NFTs, there are actionable ways to mint smarter.

Whether you’re launching your first NFT collection or scaling your fifth, the techniques in this guide can help you stay competitive and sustainable in a cost-sensitive Web3 economy.

Blockchain investigator ZachXBT has raised concerns about the crypto industry’s ability to address security breaches and illicit fund movements following his involvement in freezing funds from the recent Bybit hack. 

He argued that persistent vulnerabilities and inadequate responses from key players enable malicious actors to exploit weaknesses at scale.

Systemic failures

ZachXBT said that many of these exploits are caused by issues stemming from the fundamental flaws in both decentralized and centralized platforms.

According to his findings, some “so-called decentralized protocols” generate nearly all their volume and revenue from illicit actors, such as the Democratic People’s Republic of Korea (DPRK). 

He noted that these platforms fail to take responsibility for facilitating illicit financial activity. Meanwhile, centralized exchanges delay responding to verified threat intelligence, allowing stolen assets to be laundered within minutes.

Additionally, know-your-transaction (KYT) solutions that are designed to detect illicit fund movements are frequently circumvented. At the same time, know-your-customer (KYC) measures often fail due to compromised user data and the ability to buy accounts. 

ZachXBT emphasized that KYC issues are not exclusive to crypto and reflect broader regulatory failures in financial oversight.

Barriers to effective solutions

While acknowledging the risks of excessive government intervention, ZachXBT said he doubts the industry can effectively self-regulate. 

He identified several obstacles to meaningful reform, such as large exchanges and services lacking rapid-response teams capable of addressing verified threat intelligence in real time.

In addition, these platforms often fail to support users impacted by hacks, sometimes withholding account data to limit liability. The legal recovery process for victims is slow, with certain exchanges resisting efforts to return stolen funds.

Centralized stablecoin issuers do not block addresses directly tied to major hacks, allowing illicit actors to retain access to stablecoin liquidity. He claims compliance tools used by major firms like Coinbase and Circle do not regularly flag illegal activity.

Meanwhile, some decentralized protocols fail to reassess their design despite most of their transaction volume originating from illicit sources.

ZachXBT pointed to new blockchain networks and cross-chain bridges that neglect basic analytics or security measures. He also flagged over-the-counter trading clusters in China operating on Tron, which continue to handle high volumes of illicit funds with little oversight.

Despite raising these concerns, ZachXBT clarifies that he does not advocate for increased government oversight but points out the crypto sector’s failure to address security gaps proactively. 

Without industry-wide improvements in incident response, stablecoin issuer policies, and analytics integration, the problem is unlikely to be resolved. ZachXBT’s findings suggest that, for now, illicit actors remain steps ahead of the industry’s security measures.

Mentioned in this article

You might be surprised by how often you rely on digital agreements. Whenever you hear about decentralized services or see a blockchain-based payment, a piece of computer code—called a smart contract—runs behind the scenes. But here’s a question for you: what if that code has vulnerabilities?

Smart Contract flaws are gaps or awkward behaviours in the code that can lead to problems. These problems could cause lost funds, broken systems, or people losing confidence in a project, as a single faulty line of code can open a window of opportunity for attackers. Keep reading to learn about some widespread security holes and real-life cases.

Smart Contracts in Web3, Blockchain, and NFTs

Blockchain networks—such as Ethereum and Solana—host the code that powers these new systems, making automated transactions possible without relying on a centralized authority. NFTs go one step further, letting you own unique digital collectibles, in-game items, or virtual property with transparent rules for minting and trading.

At the heart of all this progress are smart contracts—tiny blocks of code that set the terms and handle the details independently. They’re the reason you can lend tokens, buy art, or join a DAO without asking for permission from a third party.

But if these contracts contain flaws, entire projects can be thrown off course. That’s why security and clarity in smart contract design are so important.

Common Smart Contract Vulnerabilities

Reentrancy Attacks

A reentrancy attack happens when a contract calls external code before it updates its records. This creates a tiny window for someone to do the same action again—like withdrawing funds—before the contract notices the first withdrawal. A famous example is the DAO hack, where multiple withdrawals occurred in a single transaction, causing a massive loss of assets.

Integer Overflow & Underflow

Numbers that go beyond (or below) their expected ranges can suddenly “wrap around” to an unexpected value. For example, an unsigned integer dropping below zero might become a huge positive number, giving attackers an edge. Developers often use libraries that check for arithmetic wraparounds to ward off these issues.

Unchecked External Calls

Many contracts depend on external code, and if the contract never checks whether these external calls succeed or fail, it can lose track of funds or let in malicious code.

Unprotected Self-Destruct Functions

Some contracts include a self-destruct function that can shut down the entire contract and hand over the remaining assets to a specified address. If anyone can call this function, an attacker could destroy your contract at will and walk off with whatever’s left.

Front-Running Attacks

On public blockchains, all transactions line up in a queue. Attackers can pay higher transaction fees to jump ahead, letting them profit from price changes or execute trades before others. Strategies like private transaction methods or careful contract design can reduce these risks.

Poor Randomness Implementation

Generating genuine randomness on a blockchain is difficult because the network’s outputs follow predictable patterns. If the contract relies on easily guessed values, like timestamps, attackers might sway the results. It’s safer to pull in random values from external sources or use special algorithms designed to produce less predictable outcomes.

Access Control Issues

Sometimes, developers set up insufficient checks on who can run sensitive contract functions. Depending on tx.origin is especially dangerous because other contracts can fake it. Always make sure you confirm the true caller to keep unauthorized users from taking over key parts of your system.

Logic Errors & Business Logic Vulnerabilities

Even if your code compiles without glitches, the actual logic might not match your intended rules. An auction contract, for instance, could let a bidder “win” without actually paying. Thorough testing is the best way to confirm that each function behaves the way you want

Gas Limit & Denial of Service (DoS)

Smart contracts have a built-in limit on how many operations they can perform before running out of gas. Too many complex operations or large loops might cause a failure. Attackers can also flood the network with lots of tiny transactions to bog things down and deny service to legitimate users.

Real-World Examples

Bybit Exchange Hack (February 2025)

You might have heard of Bybit, which is a well-known spot for trading crypto. In February 2025, though, it took a huge hit. Attackers found a gap in the code that handled Ethereum transfers between Bybit’s cold and warm wallets, and they stole around $1.4 billion worth of ETH. Even a respected platform can lose big if just one part of its security puzzle is missing.

zkLend Hack (February 2025)

Over on Starknet, zkLend faced its own crisis—roughly $9.57 million disappeared because of an innocent-sounding decimal precision glitch. Basically, when the code tried to handle numbers with certain decimals, it left a loophole big enough for an attacker to slip through and inflate their balances. This episode shows how one tiny detail—like a small rounding slip—can balloon into a massive problem.

GemPad Hack (December 2024)

GemPad is all about making smart contract creation easier, but its ease of use still needs solid security. In December 2024, attackers used a reentrancy weakness to pull $1.9 million from various blockchains. If you leave any door open, someone will find a way in, no matter how user-friendly your platform might be.

WazirX Hack (July 2024)

WazirX, a large exchange in India, discovered how much damage can happen when a smart contract isn’t fully protected. Attackers changed the contract rules handling its multisignature wallet, giving them a green light to drain user funds—nearly $234.9 million. WazirX had to freeze operations on the spot. It’s a harsh lesson that if your wallet’s control code can be tampered with, having multiple signatures won’t save you.

All these hacks highlight just how big the stakes are in smart contract security. And it’s not just centralized exchanges that face these dangers—NFT projects can also take a big hit if their code has weak spots.

The Idols NFT Exploit (January 2025)

Ethereum’s The Idols NFT project faced a serious setback, losing around $340,000 worth of stETH due to a coding slip in its _beforeTokenTransfer function. Attackers exploited the error by repeatedly moving their NFTs, which allowed them to claim staked Ether rewards more than once.

Closing Thoughts

The growth of Web3 and blockchain technology brings unprecedented opportunities, but as these real-world attacks remind us, they also raise the stakes for security. Single flaws in smart contract code can unravel entire ecosystems, wipe out user funds, and threaten a project’s reputation.

Vigilance pays off. Careful code reviews, audits by experienced professionals, and well-tested functionality can go a long way toward protecting smart contracts.

February 28th What can you learn from Bibit Hacks?

Bybit Hack, the largest cryptocurrency theft in history, manipulated the approval of the exchange with the $1.46 billion theft stolen through malware, identifying the North Korean Lazarus group as the perpetrator. Hackers have quickly washed funds using encrypted services such as decentralized exchanges, cross-chain bridges and tornado caches, obscure trucks, and complicated recovery efforts despite blockchain forensic companies frozen some assets. Beyond this case, authorized entities and cybercriminals are attempting to leverage cryptocurrencies to bypass financial management to fund illegal activities through anonymous transactions and No-KYC platforms. Cryptocurrencies provide economic sovereignty and resistance to censorship, but their roles are destroyed by bad actors who use them to promote illegal finances, present ongoing challenges to governments, and emphasize the difficulty of reverse the profound financial destruction introduced by blockchain technology.

Overview of the biggest hacks in history

On February 21, 2025, BYBIT, the world’s second largest cryptocurrency exchange based in Dubai, suffered a major security breaches, resulting in the theft of approximately $1.46 billion worth of digital assets. The attack reportedly was carried out using sophisticated forms of malware that manipulates the bibit transaction approval process, allowing for unauthorized transfers to external wallets controlled by the perpetrator. The incident marks the largest crypto theft ever recorded, surpassing previous well-known infringements, both in the cryptocurrency and the broader financial industry.

Blockchain security companies, including Elliptic and Arkham Intelligence, have attributed the attacks to Lazarus Group, a cybercriminal organization linked to North Korea. The group has a well-documented history targeting cryptocurrency platforms, and has stole billions of dollars in digital assets over the years. Following the established washing patterns, the attackers quickly converted stolen ether (ETH) into Bitcoin and other cryptocurrencies. The funds were then distributed to multiple wallets, leveraging decentralized exchanges (DEXS), cross-chain bridges, and other obfuscation techniques to hamper tracking efforts.

The scale of the attack has sparked concerns over security vulnerabilities within some centralized cryptocurrency exchanges. A key factor that enabled the exploit was the compromise of Bibit’s multi-signature wallet system through attacks in which signers deceived signers to approve fraudulent transactions. Precautions that may mitigate violations include stricter access control, enhanced authentication protocols, improved monitoring of transaction anomalies, and the use of multiple air-suppressed cold storage for high-value assets. Keeping $1.4 billion in Ethereum in one wallet can be considered a key center of failure. Furthermore, more stringent cybersecurity training for employees handling critical transactions could potentially help prevent social engineering tactics from being successful.

In response to violations, BYBIT has worked closely with blockchain forensic companies and law enforcement to track and recover stolen funds. Some of the assets have already been frozen by cryptocurrency service providers that flag suspicious transactions. Meanwhile, BYBIT has ensured that users will absorb losses and continue to process withdrawals without interruption. The incident highlights the persistent threat of cyberattacks on cryptocurrency platforms and the need for industry-wide improvements in security infrastructure to prevent increasingly sophisticated threats.

Illegal funds are still on the move

Following the theft, attackers began carrying out sophisticated laundry operations to obscure the origins of the stolen assets and prevent them from recovering. The first step involved converting stolen tokens such as Steth and Meth to ETH via DEX. The move may be aimed at avoiding potential interventions from token issuers that could freeze the infringed assets. Unlike centralized exchanges that require identity verification, DEXS operates without an intermediary, making it an effective tool for washing illegal funds.

Once an asset was converted to ETH, hackers adopted a common laundry technique known as “layering” to obfuscate transaction trails. The funds are distributed across hundreds of intermediate wallets, each receiving a relatively small amount, making tracking more complicated. The attackers then leveraged cross-chain bridges to move assets between different blockchain networks, further complicating forensic analysis. This tactic is frequently used by cybercriminals and utilizes fragmented surveillance across various blockchain ecosystems, making it difficult for investigators to track stolen funds. About $335 million stolen $1.466 billion from BYBit has already been washed through decentralized exchanges, cross-chain bridges and cryptographic services, with about $900 million still remaining in hacker control.

Another washing method used by hackers involved sending some of the stolen ETH to cryptographic service services such as Tornado Cash or similar platforms. These services break the link between senders and recipients by pooling multiple transactions and redistributing them in a way that obscures the source of funds. Blockchain transactions are inherently transparent, but mixing services introduce additional layers of anonymity, making it extremely difficult for investigators to return illegal funds to their origins. The attackers also engaged in “peel chain” transactions. This means that funds move continuously with a slight increase in multiple addresses, gradually returning to a wider crypto ecosystem.

Despite these sophisticated efforts, blockchain analytics companies and law enforcement are actively tracking stolen funds and identifying and flagging wallets involved in the laundry process. Several cryptocurrency service providers respond by freezing hacker-linked assets, limiting their ability to cash out. However, a significant portion of the stolen funds remain circulated, and hackers may employ a variety of laundry techniques over the coming weeks to move their remaining holdings undetected. Ongoing research highlights both the effectiveness of blockchain forensic tools and the persistent challenge of fighting financial crime in a decentralized space.

As crypto adoption increases, authorities are unable to control the movement of funds

Beyond the Bibit Hack, various threat actors, including state-sponsored cybercriminal groups and authorized entities, were increasingly turning into cryptocurrencies as a way to bypass financial restrictions. These actors leverage the pseudonymity of blockchain transactions, DEX, and cross-chain bridges to move funds outside the monitoring of regulated financial institutions. International sanction-based countries such as North Korea, Iran and Russia are linked to illegal crypto transactions to use these digital assets to fund state operations, such as military programs and espionage. The ability to operate outside of traditional banking networks makes these actors a powerful tool to bypass the restrictions imposed by the global financial system, avoid money laundering (AML) and counter terrorism (CFT) regulation funding.

One of the main methods used to obscure illegal financial flows is the use of mixing services and coin swapping platforms that promote anonymous asset remittances. Tumblers like Tornado Cash are widely used by cybercriminals and authorized entities, obfuscating transaction trails, making it difficult for blockchain analysts to return illegal funds to their sources. Additionally, the No-Kyc Exchange and Peer-to-Peer Marketplace offer even more opportunities for bad actors to cash out stolen or licensed funds with minimal surveillance. These platforms operate in jurisdictions with loose regulations enforcement, allowing users to trade large quantities of cryptocurrencies without scrutiny imposed by obedient financial institutions.

Cross-chain bridging has also emerged as a key challenge for financial regulators as it allows authorized entities to transfer funds to various blockchain networks while avoiding detection. By leveraging the Defi protocol, illegal actors can convert and move assets between networks, complicating efforts to freeze or track illegally acquired funds. Some authorized entities are known to utilize their own blockchain-based financial infrastructure, maintain liquidity and even issue stable or digital assets to carry out international transactions outside the scope of traditional financial surveillance. The increasing sophistication of these tactics has led regulators to step up scrutiny of the crypto industry and promote stricter compliance measures.

Despite these efforts, the transnational, decentralized nature of cryptocurrencies continues to pose a major obstacle to enforcement agencies seeking to crack down on illegal financial flows. Threat actors, including ransomware groups, darknet markets and cybercrime syndicates, are increasingly adopting cryptocurrencies to promote payments and wash illegal incomes. Lack of centralized control and the ability to trade without intermediaries make it difficult for governments and regulators to impose effective restrictions. Advances in blockchain analytics and forensic tools have improved detection capabilities, but the ongoing adaptation of money laundering techniques by licensed entities and cybercriminals demonstrates the persistent cat and mouse dynamics between regulators and illegal actors in the digital financial ecosystem.

The rise of decentralized financial technologies, particularly cryptocurrencies, have fundamentally changed the relationship between government and financial control, effectively enabling the “separation of money from the state.” Initially, it was told as a means of resistance to financial sovereignty and censorship, but this shift had unintended consequences that challenged the global regulatory framework. Cryptocurrency created an alternative financial system that operates beyond state surveillance, allowing licensed entities, cybercriminals and fraudsters to move funds outside traditional banking networks. This decentralization has weakened the government’s ability to enforce economic sanctions, implement capital controls and regulate illegal financial flows, making it even more difficult to contain the effects of fraudsters. This paradigm shift is similar to Pandora’s box, with no central authority that has no complete control over blockchain transactions, and is almost impossible to reverse after opening. As the financial environment continues to evolve, policymakers and regulators face an ongoing dilemma. It is a way to mitigate the risks posed by decentralized money without undermining the co-innovation that redefines global finance.

]]> https://earlybirdsinvest.com/what-can-you-learn-from-bibit-hacks/feed/ 0 22485