Bybit Exploiter Launders Over 50% of Stolen Funds

The Bybit exploit, which saw over $1.4 billion stolen in the largest crypto hack in history, has now taken another twist—over half of the stolen funds have been successfully laundered within a week.

Despite onchain analysts exposing the hacker’s identity, the Bybit exploiter has already laundered $605 million worth of Ether (ETH), according to Lookonchain.

📉 Over $600M Laundered, $514M Still Held

Blockchain intelligence firm Lookonchain revealed in a February 28 X post:

“So far, the #Bybit hacker has laundered 270K $ETH ($605M, 54% of the stolen funds) and still holds 229,395 $ETH ($514M).”

Multiple blockchain analytics firms, including Arkham Intelligence, have identified North Korea’s Lazarus Group as the main culprit behind the exploit.

🔄 THORChain Used to Move Stolen Funds, Devs Exit Amid Backlash

To evade detection, the exploiters used THORChain, a crosschain asset swap protocol, to move funds.

🔹 THORChain’s swap volume surged past $1 billion after the Bybit hack, per Cointelegraph.
🔹 THORChain faced criticism for enabling Lazarus Group to move illicit funds.
🔹 A vote to block hacker-linked transactions was overturned, sparking internal conflict.

In response, THORChain core developer “Pluto” abruptly announced their exit on February 27, stating:

“Effectively immediately, I will no longer be contributing to THORChain.”

Pluto added that they would assist with an orderly transition before fully stepping away.

Meanwhile, THORChain validator “TCB” also threatened to leave unless a rapid solution was adopted to block North Korean transactions.

🚔 FBI & U.S. Treasury Call for Crypto Industry Action

Amid concerns over Lazarus Group’s growing influence, the FBI urged exchanges and validators to block the group’s transactions.

However, THORChain founder John-Paul Thorbjornsen defended the platform, stating:

“None of the sanctioned wallet addresses listed by the FBI and OFAC has ever interacted with the protocol.”

He further argued that hackers are moving funds too fast for existing tracking systems to effectively block them in real-time.

💭 The Bottom Line: Can Crypto Networks Stop Lazarus Group?

With Lazarus Group laundering funds at record speed, questions are mounting over how decentralized protocols like THORChain should handle illicit activity.

🔹 Should validators censor transactions?
🔹 Will more developers exit THORChain?
🔹 Can authorities stop Lazarus Group before they cash out completely?

As the Bybit hack fallout continues, the debate over privacy, censorship, and security in DeFi is reaching a critical breaking point.