Over 27.6% in Lazarus-Linked Crypto ‘Goes Dark,’ Bybit CEO Warns

Over a quarter of the $1.4 billion in crypto stolen by North Korea’s Lazarus Group earlier this year has vanished, according to Bybit CEO Ben Zhou.

The $1.4 billion hack, carried out in February, targeted Bybit’s cold wallet infrastructure and marked the largest crypto exchange exploit in history.

In an update posted on X on April 21, Zhou revealed that 27.6% of the stolen funds, roughly 500,000 ETH, have “gone dark” and are no longer traceable on-chain.

4.21.25 Executive Summary on Hacked Funds:
Total hacked funds of USD 1.4bn around 500k ETH. 68.57% remain traceable, 27.59% have gone dark, 3.84% have been frozen. The untraceable funds primarily flowed into mixers then through bridges to P2P and OTC platforms.
Recently, we have…

— Ben Zhou (@benbybit) April 21, 2025

“Funds are being funneled through mixers, then bridged across networks before landing on peer-to-peer and OTC platforms,” Zhou explained. “This makes them incredibly hard to trace or recover.”

Zhou noted that 68.6% of the stolen funds remain traceable, while just 3.8% have been frozen.

Inside the Heist: Mixers, Cross-Chains, and 35,000 Wallets

Bybit CEO said Lazarus Group used a complex cocktail of privacy tools and cross-chain bridges to conceal their tracks. 

According to him, the group primarily used the Wasabi mixer in the early stages to cover up Bitcoin transactions. From there, the funds were routed through other tools, including CryptoMixer, Tornado Cash, and Railgun.

Roughly 432,748 ETH, equivalent to 84.45% of the stolen Ether, was swapped into Bitcoin using the Thorchain protocol. Of that, nearly 67.25% was dispersed across over 35,000 wallets, further complicating any recovery efforts.

On the Ethereum side, approximately 5,991 ETH ($16.77 million) remains scattered across 12,000 wallets. Meanwhile, on-chain investigators have identified 944 BTC (around $90.6 million) that was laundered through Wasabi alone.

Bounty Hunters Step Up, but Only Scratch the Surface

To help recover the stolen assets, Bybit launched a $140 million Lazarus Bounty program in February. Since then, the exchange has received 5,443 reports, but only 70 have been validated.

So far, $2.3 million in rewards have gone to 12 bounty hunters. The biggest win came from the Mantle layer-2 platform, whose intel helped freeze $42 million worth of stolen crypto.

“We welcome more reports. We need more bounty hunters that can decode mixers,” Zhou urged, calling for wider collaboration among blockchain sleuths.

Meanwhile, eXch, a privacy-first crypto exchange, is shutting down on May 1 amid allegations of involvement in Lazarus-linked laundering, despite denying any ties.