Bybit hackers resume laundering activities, moving another 62,200 ETH

admin03 mins


North Korea’s Lazarus Group laundered another 62,200 Ether, worth $138 million, from the Feb. 21 Bybit hack on March 1 — leaving only 156,500 left to be moved, a pseudonymous crypto analyst noted.

Approximately 343,000 Ether (ETH) of the 499,000 Ether stolen from the $1.4 billion Bybit hack has been moved, said X user EmberCN, who expects the remaining funds to be cleared in the next three days.

The 343,000 Ether moved equates to 68.7% of the stolen funds — up from 54% on Feb. 28.

EmberCN previously noted that laundering activities had slowed amid efforts from the US Federal Bureau of Investigation calling on node operators, crypto exchanges, bridges and others to block transactions linked to the Bybit hackers.

Hackers, North Korea, Money Laundering, THORChain, Bybit, Lazarus Group

The Bybit hacker still has another $346 million of Ether left to launder, should they choose. Source: EmberCN

The FBI shared 51 Ethereum addresses operated by, or linked to, the Bybit hackers, while blockchain analytics firm Elliptic has flagged over 11,000 crypto wallet addresses possibly linked to them.

Crypto forensics firm Chainalysis said the hackers had converted portions of the stolen Ether into Bitcoin (BTC), the Dai (DAI) stablecoin and other assets through decentralized exchanges, crosschain bridges and instant swap services without Know Your Customer protocols.

One of those protocols includes crosschain asset swap protocol THORChain. Developers behind the protocol have received heavy criticism for facilitating a significant share of transfers made by the North Korean hackers.

One of THORChain’s developers, known as “Pluto,” said they would no longer contribute to the protocol after a vote to block North Korean hacker-linked transactions was reverted.

Related: Bybit hack forensics show SafeWallet compromise led to stolen funds

In a note to Cointelegraph, THORChain’s founder John-Paul Thorbjornsen said he no longer has involvement with the crosschain protocol, while pointing out that none of the sanctioned crypto wallet addresses listed by the FBI and the Treasury’s Office of Foreign Assets Control have interacted with the protocol.

The $1.4 billion Bybit hack on Feb. 21 was by far the largest exploit in crypto industry — more than doubling losses from the $650 million Ronin bridge hack on March 23, 2022.

Magazine: MegaETH launch could save Ethereum… but at what cost?