The cybercriminals behind the $1.39 billion Bybit exploit have reportedly successfully laundered all stolen funds in just ten days, leveraging decentralized finance (DeFi) protocols to bypass law enforcement and blockchain tracking.

Despite the efforts of crypto analytics firms, exchanges, and authorities, the perpetrators managed to convert and distribute the stolen funds across thousands of wallets, making recovery nearly impossible.

How the Laundering Unfolded

Blockchain analytics firm EmberCN began tracking the movement of the stolen funds immediately after the attack. According to their reports:

• Within the first 60 hours, the hacker had laundered 89,000 ETH (worth $224 million).
• The following day, another 45,900 ETH ($113 million) was processed, bringing the total to 135,000 ETH.
• By February 27, the attacker swapped 71,000 ETH (~$170 million), pushing the laundered amount past 206,000 ETH.

At that point, the hacker was laundering approximately 45,000 ETH per day, but still had 292,000 ETH left to clean, worth an estimated $685 million.

The attacker continued moving funds aggressively, except for a brief pause on March 1, where they only managed to process 14,300 ETH ($32.2 million). The next day, laundering resumed at full speed, with 62,200 ETH converted.

By the morning of March 4, all stolen assets had been successfully laundered according to EmberCN’s final report.

Bybit CEO’s Perspective

Ben Zhou, CEO of Bybit, provided additional insights into the attack via an X post. He revealed that:

• 83% of the stolen funds ($1 billion) were converted into Bitcoin (BTC) and spread across 7,000 wallets.
• 20% of the stolen assets remain untraceable, while 3% have been frozen.
• The eXch exchange was used to launder 79,655 ETH, while an additional 40,233 ETH was moved via OKX’s web3 wallet.

Although investigators have managed to trace 16,680 ETH, the remainder seems to have vanished—unless further intelligence emerges from OKX or other sources.

THORChain: The Key Laundering Hub

According to Zhou, the primary tool used by the hackers was THORChain, a cross-chain liquidity protocol.

• More than 361,000 ETH ($900 million) is believed to have been swapped via THORChain.
• The FBI has linked the attack to North Korea’s Lazarus Group, an infamous state-sponsored hacking collective.

With the funds now scattered across multiple chains and wallets, tracking and recovering them has become increasingly difficult. Unless a breakthrough emerges, Bybit’s chances of retrieving the stolen assets remain slim.