Bybit exchange was targeted in February 2025 and CEO Ben Zhou has publicly disclosed that a portion of the ill-gotten Bitcoin, specifically valued at $16 million, was processed using the Wasabi mixer before being channeled to peer-to-peer (P2P) platforms.
Zhou detailed that of the estimated $1.5 billion in cryptocurrency pilfered—predominantly Ether (ETH)—approximately 86% underwent a conversion into Bitcoin (BTC), culminating in a sum of 12,836 BTC.
According to Zhou’s report, a significant 86% of the substantial Ether haul, originally amounting to 440,091 ETH (valued at approximately $1.23 billion), was transformed into 12,836 BTC.
Following this conversion, these Bitcoin holdings were further distributed among over 9,000 digital wallets (specifically 9,117), with each wallet holding roughly 1.41 BTC on average.
$16 Million Bybit Bitcoin Laundered
Investigations point towards the North Korean cybercrime syndicate, the Lazarus Group, as the perpetrators orchestrating the laundering of these illicit funds.
Their methods involve employing Bitcoin mixing services, such as Wasabi, CryptoMixer, and Railgun, alongside leveraging peer-to-peer (P2P) trading networks to obscure the trail of the stolen crypto assets.
It has been previously documented that the hackers initially funneled a considerable amount of the stolen Ether through THORChain, a decentralized liquidity protocol, before ultimately shifting to Bitcoin.
Wasabi is identified as a Bitcoin mixing service that employs CoinJoin technology, a cryptographic method designed to obscure the transactional history of Bitcoin for enhanced privacy.
Zhou conveyed his concerns via the social media platform X, stating, “We anticipate this pattern of mixer usage to intensify as a laundering tactic.
Decoding mixer transactions presents a major hurdle in our ongoing recovery efforts.”
Recent data from Bybit indicates that while a substantial 88.8% of the misappropriated funds are still considered traceable, 7.6% have become untraceable through these laundering methods, and a further 3.5% have been successfully subject to freezing actions.
Also Read: EU Examines OKX over Alleged Bybit Hack
