Lazarus Moves $27M in ETH After Bybit Hack

The Lazarus Group has moved 10,000 Ethereum (ETH)—valued at $27 million—to a wallet labeled Bybit Exploiter 54 on Feb. 22, in an attempt to launder stolen funds, according to on-chain analytics firm Lookonchain.

Further on-chain data, analyzed by ZackXBT, reveals that the North Korean-linked hacking group currently controls:

489,395 ETH (worth $1.3 billion)
15,000 Mantle Restaked ETH (cmETH)
53 additional wallets holding illicit assets

Bybit hacker(from Lazarus Group) has transferred 10,000 $ETH($27M) to Bybit Exploiter 54 and began laundering funds.

Bybit hacker currently holds 489,395 $ETH($1.32B) and 15,000 cmETH(unable to withdraw) in 53 other wallets. pic.twitter.com/mkeTec5gfR
— Lookonchain (@lookonchain) February 22, 2025

Lazarus Rapidly Moving Stolen Funds

According to Etherscan, Lazarus has been actively shuffling funds between wallets, completing 83 transactions in the past eight hours alone.

We just froze 181k USDt connected to the ByBit hack.
Might not be much but it's honest work.
We keep monitoring.
Kudos to @zachxbt
— Paolo Ardoino 🤖 (@paoloardoino) February 22, 2025

One of the most recent transactions from Bybit Exploiter 54 transferred 66 ETH (~$182,831) to a wallet ending in “CE9” at 01:23:47 PM UTC on Feb. 22.

The $1.4 billion Bybit hack—now labeled the largest crypto hack in history—sent shockwaves through the market, triggering an 8% ETH price drop in a single day and widespread altcoin declines.

Bybit Hack Recovery Efforts Underway

Despite the massive breach, recovery efforts are progressing:

$43 million in stolen funds have been recovered with help from Mantle, SEAL, and mETH teams, per Polygon’s Chief Information Security Officer, Mudit Gupta.
Tether CEO Paolo Ardoino confirmed that the stablecoin issuer froze 181,000 USDT linked to the hack on Feb. 22.
Bybit has launched a bounty program, offering up to 10% of the stolen funds (worth $140 million) to contributors who assist in recovering stolen assets.

Bybit Restores Full Withdrawals

Bybit CEO Ben Zhou announced that withdrawals have returned to normal, following congestion caused by a backlog of pending transactions.

In a recent social media post, Zhou reassured users:

“Customers can withdraw any amount without time delays or issues.”

Bybit’s response to the security breach has received widespread praise, particularly for its transparent communication and commitment to keeping withdrawal requests open during the crisis.

With recovery efforts ongoing, all eyes remain on whether authorities and blockchain forensic teams can trace and reclaim more of the stolen funds.

This article is for information purposes only and should not be considered trading or investment advice. Nothing herein shall be construed as financial, legal, or tax advice. Bullish Times is a marketing agency committed to providing corporate-grade press coverage and shall not be liable for any loss or damage arising from reliance on this information. Readers should perform their own research and due diligence before engaging in any financial activities.

Cairo Arévalo

A dedicated innovation focused professional with a strong background in business development. Enthusiastic NFT collector passionate about blockchain technology and its implementations, and committed to delivering engaging tech-related content. Involved in crypto since 2014.

View All Articles