Bybit CEO Ben Zhou has confirmed that $1.07 billion—roughly 77% of the assets stolen in the exchange’s recent $1.4 billion security breach—can still be tracked.

In a March 4 update, Zhou disclosed that hackers successfully laundered $280 million, around 20% of the 499,000 ETH stolen.

Meanwhile, investigators have managed to freeze $42 million, accounting for 3% of the compromised funds.

Zhou stated that 11 independent bounty hunters were rewarded $2.1 million for helping to freeze stolen assets. Among the top contributors were Mantle, Paraswap, and blockchain investigator ZachXBT.

THORChain’s role

Zhou revealed that the attackers converted much of the stolen ETH into Bitcoin (BTC) through THORChain, a decentralized platform designed for cross-chain asset swaps.

He stated that the hackers funneled around 83% of the stolen assets—equivalent to 417,348 ETH worth approximately $1 billion—into BTC. They then dispersed these funds across 6,954 wallets, with an average balance of 1.71 BTC per wallet.

This activity significantly boosted THORChain’s transaction volume in the last two weeks to more than $5.8 billion following the Bybit breach. Blockchain analyst EmberCN also reported that the platform earned roughly $5.5 million in fees from these transactions.

Blockchain security researcher Taylor Monahan criticized THORChain, claiming its structure enables criminal activities under the guise of decentralization. She argued that its system operates in an isolated ecosystem that benefits insiders and facilitates money laundering.

Monahan said:

“[THORChain] exists in its own little bubble that’s mostly hard criminals and the insiders who have figured out how to profit from said criminal flows directly or indirectly.”

However, Zhou stated that the funds moved through the platform can still be traced. According to him, it will be critical to freeze the funds in the coming weeks before hackers attempt to cash out through centralized exchanges, over-the-counter (OTC) desks, and peer-to-peer (P2P) networks.

ExCH and OKX involvement

Meanwhile, Zhou also reported that the stolen assets were moved through other platforms, including ExCH and OKX Web3 Proxy.

Zhou disclosed that 40,233 ETH—worth approximately $100 million—moved through OKX’s Web3 proxy. Of this amount, 16,680 ETH remains traceable, while 23,553 ETH ($65 million) requires additional information from OKX to track.

Meanwhile, 79,655 ETH—around 16% of the total stolen—was funneled through ExCH, an exchange that had previously denied facilitating illicit transactions for the Bybit hacker.

In a Feb. 23 statement, ExCH refuted claims that it had laundered funds for North Korea-linked entities but confirmed that:

“[An] insignificant portion of funds from the ByBit hack eventually entered our address 0xf1da173228fcf015f43f3ea15abbb51f0d8f1123, which was an isolated case and the only part processed by our exchange, fees from which we will be donated for the public good.”

Mentioned in this article

Thorchain, a decentralized protocol, has seen what can be explained as unwanted wind drop after a buy-bit hack by allowing users to exchange cryptocurrency across various blockchains.

According to data source Defilama, the protocol processed $4.666 billion in swaps in the week ended March 2nd. The tally exceeded $1 billion on Sunday alone.

The surge in activity followed the Crypto Exchange Bybit hack on February 22, when North Korea’s malicious presence left at $1.4 billion in ether. According to the observer, the entities used to exchange and wash funds using tocaine, resulting in record-breaking activity on the platform.

“From the first Buit-bit Exploiter Wallet, the fund was sent to even more stretch nets in the wallet. Each ‘hop’ was increasing in volume from the main wallet, increasing the amount of intermediate wallets, and value transfers became smaller and smaller.

“From Hop 2, hackers have begun interactions with third-party entities, starting fund exchanges and laundry. The entities with the highest influx of hacking include Torcaine, Paraswap, Mantle, Okrasagi and Dodo,” Nansen added.

Coindesk contacted Thorchain to comment on the issue.

According to Onchain analyst Embercn, hackers have washed the entire ETH balance in 10 days, generating record revenue for Thorchain.

“Hackers washed all 499,000 ETH ($13.9 billion) stolen from Bybit, a process that took 10 days. ETH prices fell 23% ($2,780-$2,130 today). Tall Chain, the main channels used by hackers to wash their money, won $590 million for a total of $590 million. Embercn said on X.