Bybit CEO Ben Zhou Reveals 88.87% of Lazarus Group’s $1.4B Stolen Funds Are Still Traceable

Bybit CEO Ben Zhou confirmed that an astonishing 88.87% of the $1.4 billion stolen by the infamous Lazarus Group remains traceable. Despite the hackers’ sophisticated efforts to obscure the stolen funds through various Bitcoin mixers, blockchain security experts have managed to track a significant portion of the stolen assets. This breach, one of the largest in cryptocurrency history, highlights the increasing challenges in securing digital assets, but also points to the growing capability of security firms in tracing even the most complex laundering schemes.

The Lazarus Group Hack: A Brief Overview

On February 21, 2025, Bybit, one of the largest cryptocurrency exchanges, fell victim to a massive hack orchestrated by Lazarus Group, a notorious North Korean hacking group. The attack resulted in the theft of approximately 500,000 ETH, worth around $1.4 billion. This breach became the largest in cryptocurrency history, surpassing even the infamous Poly Network hack of 2021 which saw $600 million stolen.

Following the attack, Lazarus Group quickly began converting the stolen ETH into Bitcoin (BTC). They spread the funds across 9,117 wallets, using Bitcoin mixers like Wasabi, CryptoMixer, Railgun, and Tornado Cash to evade detection and tracing efforts. Despite these efforts, the Bybit team, along with blockchain security experts, remain confident that most of the stolen funds can still be recovered.

Bybit CEO Ben Zhou’s Update: What We Know So Far

In a March 20, 2025 update on X (formerly Twitter), Ben Zhou provided a detailed breakdown of the tracking efforts and the current status of the stolen funds. According to Zhou:

• 88.87% of the stolen funds are still traceable.
• 3.54% of the stolen assets have already been frozen.
• 7.59% of the funds have been transferred to the dark web and are considered untraceable at this time.

Zhou further revealed that 86.29% of the stolen assets—440,091 ETH worth approximately $1.23 billion—were converted into 12,836 BTC, which was then distributed across 9,117 different wallets. The hackers utilized Bitcoin mixers to launder the funds and cover their tracks, with at least 193 BTC funneled into Wasabi before being further dispersed to peer-to-peer vendors.

The Challenge of Tracing Funds Through Mixers

While mixers like Wasabi and Tornado Cash are designed to anonymize transactions by mixing the stolen funds with others, they are not foolproof. Zhou acknowledged the significant challenge posed by these tools but also emphasized that blockchain security firms, such as Arkham Intelligence, have made considerable progress in identifying the flow of stolen assets.

Despite the hackers’ attempts to conceal their activities, blockchain forensic tools are capable of following the path of funds through mixers and decentralized exchanges. Security experts have been able to trace portions of the stolen funds that were laundered through protocols like THORChain, within a matter of just 10 days.

Zhou’s team has also been working with bounty hunters to aid in tracking the funds. To date, Bybit has received over 5,000 bounty reports, of which 63 reports have proven valid and useful in narrowing down the stolen funds.

The Role of Bounty Hunters in Recovery

The involvement of bounty hunters has been a crucial aspect of the recovery efforts. Bybit’s call to action encouraged individuals and blockchain investigators to contribute to the search for the stolen funds. As of now, over 5,000 bounty reports have been submitted, with 63 of them yielding useful information. This collaborative effort between Bybit, bounty hunters, and blockchain security firms has significantly aided in tracing the stolen funds, despite the hackers’ best efforts to remain anonymous.

The growing number of bounty reports and active engagement from the blockchain community demonstrates the industry’s commitment to improving security and asset recovery in the face of sophisticated attacks.

The Future of Crypto Exchange Security: Lessons from the Hack

This massive breach underscores a fundamental vulnerability in the cryptocurrency space: even the most secure exchanges are not immune to attacks. The Lazarus Group hack has raised important questions about the security of centralized exchanges and the methods hackers employ to steal funds. The attack serves as a stark reminder that cryptocurrency exchanges need to continue investing heavily in security protocols and fraud prevention measures to safeguard users’ assets.

In response to this hack, there is likely to be increased pressure on exchanges to implement more robust transaction monitoring systems, multi-signature wallets, and anti-money laundering (AML) procedures. While efforts to trace and recover stolen funds are ongoing, the hack has also highlighted the need for improved industry-wide collaboration between exchanges, law enforcement agencies, and private sector entities in combating cryptocurrency crime.

Recovery Efforts: Will the Funds Be Fully Recovered?

While much of the stolen assets remain traceable, it’s still uncertain whether all of them will be recovered. According to Zhou, the dark web has absorbed a portion of the funds, and mixing tools have complicated the task of tracking the flow of the stolen cryptocurrency. However, with 88.87% of the funds still traceable and continued efforts from blockchain security firms and bounty hunters, there is hope that a significant portion of the funds will eventually be recovered.

The hack also serves as a crucial test case for blockchain forensic tools and asset recovery efforts, showcasing the capabilities of modern crypto security technologies in tracking down and recovering stolen assets.

A Wake-Up Call for the Crypto Industry

The Lazarus Group attack on Bybit serves as a wake-up call for the cryptocurrency industry. Despite the hackers’ best efforts to launder the stolen funds through mixers and decentralized protocols, 88.87% of the $1.4 billion remains traceable. This indicates that blockchain security tools are becoming increasingly effective at tracking illicit transactions, but the attack also highlights the vulnerabilities that still exist in the sector.

As the investigation continues, exchanges, security firms, and bounty hunters are working tirelessly to track down the remaining funds. For the crypto industry, this event underscores the importance of improving security infrastructure and collaboration to prevent future hacks and facilitate quicker recoveries.

Disclaimer: The above press release has been provided by a third party. We do not verify or endorse the content and will not be responsible for any inaccuracies, claims, or damages arising from the same.