Bybit Hack: Lazarus Group's Next Step

The stolen cryptocurrency from the massive $1.4 billion hack of Bybit is likely to be laundered through mixers as the hackers try to hide the transaction trail. According to blockchain security firm Elliptic, the Lazarus Group from North Korea may resort to using mixers, but the large amount of stolen assets could complicate the process. The hack, which occurred on February 21, resulted in the theft of approximately $1.46 billion in crypto, making it the largest crypto heist ever, surpassing previous hacks like those of Poly Network and Ronin Network. Elliptic noted that the Lazarus Group typically follows a specific laundering pattern, starting with exchanging stolen tokens for a native blockchain asset like ETH. They are currently in the second stage of laundering, which involves "layering" the stolen funds to obscure their origins. This can include using multiple wallets, cross-chain transfers, decentralized exchanges, and mixers such as Tornado Cash.

Within two hours of the theft, the stolen assets were distributed to 50 wallets, each containing about 10,000 ETH, and these wallets are now being systematically emptied. Elliptic identified one service as a significant enabler of this laundering process, which has ignored requests from Bybit to halt these activities. They reported that millions of dollars worth of the stolen assets have been exchanged anonymously through a platform known as eXch. However, on February 23, eXch denied any involvement in laundering for the Lazarus Group. Between 2020 and 2023, the Lazarus Group laundered over $200 million using mixers and peer-to-peer marketplaces, although reports suggest they are shifting towards cross-chain bridges for their laundering efforts. Meanwhile, Bybit's CEO announced that the exchange has completely replenished the $1.4 billion worth of Ether that was stolen and will release a new proof-of-reserve report soon.