Bybit’s Missing Billions Going Dark as Mixers and OTC Markets Obscure the Trail

Published April 21, 2025 | 7:22 AM UTC
By Giuseppe Ciccomascolo, Edited by Insha Zia

In a complex and ongoing saga surrounding one of the largest hacks in cryptocurrency history, the Bybit platform finds itself grappling with substantial losses due to sophisticated laundering methods employed by hackers. The incident, which saw approximately $1.4 billion in crypto stolen, highlights the challenges law enforcement and blockchain analysts face in tracking illicit funds as they navigate through increasingly sophisticated channels, including mixers and over-the-counter (OTC) markets.

Overview of the Hack

As of April 21, 2025, only 68.57% of the hacked funds—about 500,000 ETH—are currently traceable. While blockchain forensic teams are actively tracking much of the stolen cryptocurrency, 28% of the total amount has become untraceable, and a mere 3.8% of it has been frozen. According to Bybit’s co-founder and CEO Ben Zhou, most of the untraceable funds had been funneled through mixing services and cross-chain bridges, complicating recovery efforts.

“Hackers are becoming more adept at hiding the provenance of stolen cryptocurrency,” Zhou explained. He further noted that the notorious Wasabi Mixer has emerged as a primary tool for groups linked to North Korea, helping obscure their financial activities. After passing through Wasabi, these funds are typically routed through additional platforms such as CryptoMixer, Tornado Cash, and Railgun.

The Movement of Stolen Funds

Following the initial breach, approximately 432,748 ETH (valued at about $1.21 billion) has been strategically transferred to Bitcoin via platforms like Thorchain. A significant portion of this amount, around 342,975 ETH, was converted into approximately 10,003 BTC and dispersed across more than 35,000 wallets, averaging only 0.28 BTC per wallet. This strategy appears designed to fragment the assets further and enhance obfuscation.

Additionally, 944 BTC was detected passing through Wasabi, with a fraction later re-converted back to Ethereum via similar channels. Such tactics underscore the urgency for enhanced analytical capabilities among blockchain security professionals, particularly those skilled in decoding complex mixer activities.

Community Response and Ongoing Tracking Efforts

The Lazarus Bounty platform, aimed at tracking stolen funds, has received 5,443 reports in the past 60 days, with only 70 confirmed as valid cases by Zhou. This has raised eyebrows among some community members, sparking queries about the effectiveness and transparency of the reporting system. One user expressed skepticism regarding the high number of reports yielding such a low validation rate, suggesting that it may indicate prior insider knowledge rather than a genuinely collaborative discovery effort.

“While I appreciate the effort for transparency, the statistics raise a concern,” commented Kevin Ang on social media platform X. “It seems strange that we have so little identification after such a significant theft.”

The Need for Enhanced Measures

As the digital currency landscape continues to evolve and the complexities of crypto laundering become more pronounced, the call for more skilled on-chain investigators and bounty hunters becomes increasingly urgent. Zhou himself has acknowledged the necessity of these efforts, stating, “We welcome more reports. We need more bounty hunters who can decode mixer activity—we need a lot of help down the road.”

In light of the ongoing challenges faced in tracking these missing billions, regulators and cryptocurrency platforms may need to consider developing stronger collaborative frameworks to enhance transparency and security in the industry.

Conclusion

The Bybit hack serves as a stark reminder of the vulnerabilities present within the cryptocurrency space, particularly as criminal organizations exploit advanced technology to obscure their tracks. Continuous efforts from blockchain forensic specialists, coupled with community engagement and regulatory support, will be paramount in reclaiming lost funds and safeguarding against future breaches.

For more updates on this unfolding story and other blockchain-related news, stay tuned.

Share this article: