Comprehensive Analysis of ByBit’s Crypto Fund Freeze and the Lazarus Group Exploit
ByBit, a leading cryptocurrency exchange, has disclosed that a mere fraction of the assets stolen in the massive $1.4 billion hack linked to North Korea’s notorious Lazarus Group has been successfully frozen. According to Ben Zhou, the CEO of ByBit, only 3.84% of the stolen funds have been immobilized, with the majority continuing to circulate through complex networks of mixers, cross-chain swaps, and over-the-counter (OTC) desks.
Minimal Freezing of Stolen Cryptocurrency
The internal investigation by ByBit reveals that the original theft involved approximately 500,000 ETH, valued at $1.4 billion at the time. Out of this, 68.57% remains traceable, while 27.59% has vanished from view. This lack of traceability is attributed to deliberate fragmentation and chain-hopping strategies employed by the perpetrators to hinder tracking efforts.
Advertisement Banner
The Complex Path of Laundered Cryptocurrency
According to a detailed report from ByBit dated April 21, the untraceable portion initially navigated through the Wasabi mixer, with smaller amounts subsequently filtered into other mixing services such as CryptoMixer, Tornado Cash, and Railgun. The laundered funds were then funneled through various cross-chain bridges and swap platforms, including Thorchain, eXch, Lombard, LiFi, Stargate, and SunSwap, before vanishing into peer-to-peer (P2P) and OTC fiat channels. Zhou noted that each transaction further obscures the asset’s trail, creating a complex web of tens of thousands of micro-wallets.
Ethereum and Bitcoin: Parallel Paths of Laundering
On the Ethereum blockchain, ByBit tracked 432,748 ETH—around 84.45% of the stolen amount—converted into Bitcoin via Thorchain. Approximately 67.25% of the original Ethereum, equating to 342,975 ETH, has transformed into 10,003 BTC, scattered across 35,772 different wallets, each holding an average of 0.28 BTC. Meanwhile, 5,991 ETH, representing 1.17% of the stolen assets, remains on Ethereum, distributed among 12,490 addresses with balances less than half an ether each.
The Bitcoin laundering process mirrors the Ethereum cycle. ByBit discovered that 944 BTC, or 6.34% of the converted funds, ended up in the Wasabi mixer. An additional 531 BTC, equivalent to 18,206 ETH or 3.57%, has been transferred back to Ethereum through Thorchain, highlighting the attackers’ strategy of exploiting cross-chain vulnerabilities for trading and obfuscation.
Community Efforts and Future Prospects
Efforts to track the dispersed funds are ongoing, with platforms like Lazarusbounty.com actively involved in mapping the distribution. In the last 60 days, the platform received 5,443 bounty submissions, of which only 70 were validated. The site appeals for more public involvement, urging for increased participation from bounty hunters skilled in decoding mixers.
Despite the challenges, Zhou remains optimistic about the possibility of recovering the stolen assets. He emphasized that about two-thirds of the cryptocurrency is still traceable on the blockchain, albeit highly fragmented. Future asset freezes will require coordinated efforts among centralized exchanges, cross-chain liquidity hubs, and fiat gateways.
The Current State of the Stolen Funds
As of now, the majority of the cryptocurrency tied to the Lazarus Group remains active, moving through decentralized networks via swapping, bridging, and tumbling processes. This dynamic state of the stolen funds, with only 3.84% currently frozen, underscores the vulnerabilities in global enforcement against state-sponsored crypto theft.
At the time of reporting, Ethereum is valued at $1,631. The cryptocurrency’s price remains below the 0.236 Fibonacci level on the weekly chart, reflecting ongoing market conditions.
Our Editorial Standards
At Bitcoinist, our editorial process is committed to providing meticulously researched, accurate, and impartial content. We adhere to stringent sourcing guidelines, ensuring that each piece undergoes careful review by our team of top technology experts and experienced editors. This rigorous process guarantees the integrity, relevance, and value of our content for our audience.
“`
