More than $1.4 billion in cryptocurrency, including approximately 500,000 ETH, has been stolen in recent attacks, with a significant portion still traceable, according to a new report from blockchain watchdogs investigating the Bybit large-scale hacks with suspected ties to North Korea.
Approximately 68.57% of the stolen digital assets remain traceable, while 27.59% have gone dark, having passed through mixers and other obfuscation methods. Only 3.84% of the assets have been frozen so far, leaving much of the funds in circulation and at risk of liquidation through decentralized finance platforms and peer-to-peer exchanges.
Funds Laundered Through Mixers, Bridges and OTC Channels
Blockchain intelligence firms reported that the majority of stolen funds were laundered using advanced techniques, starting with privacy mixers—primarily Wasabi, a tool previously linked to the North Korean hacking group Lazarus.
A small portion of the assets was further dispersed through other mixing tools, including CryptoMixer, Tornado Cash, and Railgun. After initial laundering, the funds were routed through cross-chain swaps and bridging platforms like Thorchain, eXch, Lombard, LiFi, Stargate, and SunSwap, eventually reaching OTC (over-the-counter) and P2P (peer-to-peer) services where they could be exchanged for fiat currencies.
Most ETH Converted to BTC; Traces Remain on Ethereum
Out of the 500,000 ETH linked to the incidents, approximately 432,748 ETH—about 84.45%, valued at around $1.21 billion—has been transferred to Bitcoin using Thorchain. A large portion of this, about 342,975 ETH (67.25%), has been converted into 10,003 BTC across nearly 36,000 wallets, each averaging 0.28 BTC.
Despite extensive laundering efforts, a small portion—about 5,991 ETH, or 1.17% of the stolen total—still resides on the Ethereum blockchain. These tokens are spread across more than 12,000 wallets.
On the Bitcoin side, 944 BTC—worth roughly $90.62 million—was processed through the Wasabi Mixer, while 531 BTC (equivalent to around 18,200 ETH) was routed back to Ethereum via Thorchain.
Lazarus Bounty Program Calls for More Help
In response to the increasing sophistication of laundering efforts, the Lazarus Bounty initiative reported receiving 5,443 bounty submissions in the past 60 days. Only 70 of these reports were deemed valid, highlighting the growing difficulty of tracking illicit funds through privacy-enhancing tools.
The organization is urging more cybersecurity professionals and analysts to assist in decoding activity within mixers and cross-chain ecosystems to aid law enforcement and asset recovery efforts.
