Bybit CEO: Majority of Lazarus-Hacked Crypto Funds Still Trackable, Bounty Efforts Ongoing

Bybit CEO Ben Zhou has revealed that a significant portion of the $1.4 billion stolen during February's massive crypto hack — orchestrated by North Korea’s Lazarus Group — remains within reach. According to Zhou, 68.6% of the stolen assets are still traceable, providing a sliver of hope for recovery efforts.

In a detailed update shared on X (formerly Twitter), Zhou outlined the status of the stolen assets:

68.6% traceable

27.6% gone dark

3.8% frozen

The February attack, which exploited weaknesses in Bybit’s cold wallet infrastructure, marked one of the largest breaches in crypto exchange history. Zhou confirmed that Lazarus used a chain of sophisticated tools to obfuscate their trail — starting with Wasabi mixer, and later routing funds through CryptoMixer, Tornado Cash, and Railgun.

Among the stolen assets:

944 BTC (~$90 million) was funneled through Wasabi

432,748 ETH (~$1.21 billion) was mostly swapped for Bitcoin using THORChain

$17 million in ETH remains scattered across over 12,000 wallets

Zhou also highlighted the complexity of the laundering process, citing the use of cross-chain swap services like THORChain, LI.FI, Stargate, and decentralized exchanges such as SunSwap.

To counter the laundering, Bybit launched the Lazarus Bounty Program, offering up to $140 million in rewards for actionable intelligence. So far:

5,443 reports were submitted

70 were valid

$2.3 million has been paid out

One major recipient, Mantle Network, helped freeze $42 million

Zhou urged more ethical hackers and blockchain analysts to step in, emphasizing the need for experts who can decode transactions routed through mixers. “We’re still in need of bounty hunters who can crack through this layer of obfuscation,” he said.

In related fallout, the eXch crypto exchange, reportedly used in the laundering process, has announced its closure effective May 1, 2025.

As crypto exchanges continue to battle increasingly advanced attack methods, Bybit’s ongoing pursuit of stolen assets highlights the evolving nature of cybersecurity and the importance of cross-platform collaboration in the digital asset space.