Bybit CEO: 77% of Hacked Funds Still Traceable, 20% Lost, 3% Frozen

Bybit CEO Ben Zhou has provided an update on the movement of hacked crypto funds, revealing that of the $1.4 billion stolen, 77% remains traceable, while 20% has gone dark, and 3% has been frozen.

In a detailed breakdown posted on X, Zhou stated that 83% of the stolen funds (417,348 ETH, worth around $1 billion) have been converted into Bitcoin across 6,954 wallets, averaging 1.71 BTC per wallet.

He emphasized that the next week will be critical for tracking and freezing funds, as hackers are expected to move assets through exchanges, OTC desks, and peer-to-peer platforms.

THORChain Facilitated $900M in Stolen ETH Transactions, Still Traceable

A significant portion of the conversion—361,255 ETH or approximately $900 million—was processed through THORChain, which remains traceable.

However, 79,655 ETH ($100 million) was funneled through OKX Web3 proxy wallets, with 16,680 ETH still traceable but 23,553 ETH ($65 million) deemed untraceable without further information from OKX Web3.

3.4.25 Executive Summary on Hacked Funds:
Total hacked funds of USD 1.4bn around 500k ETH, 77% are still traceable, 20% has gone dark, 3% have been frozen.
Breakdown:
– 83% (417,348 ETH, ~$1B) have been converted into BTC with 6,954 wallets (Average 1.71 btc each) . This and…

— Ben Zhou (@benbybit) March 4, 2025

Efforts to freeze the funds have involved 11 different entities, with Mantle, Paraswap, and on-chain investigator ZachXBT leading the charge.

To date, a total of $2.18 million in USDT has been paid to bounty hunters aiding the recovery effort.

Bybit has launched a website to track the movement of its stolen funds and is offering a bounty to entities that assist in freezing them.

As of now, the site identified seven cooperative exchanges and one uncooperative platform, eXch, a no-Know Your Customer (KYC) swap service that has refused to freeze funds linked to the hack. eXch has denied laundering funds for North Korea.

Chainflip Plans Upgrade to Block Bybit Hackers from Using Its Platform

As reported, Chainflip, a cross-chain DEX, is preparing a protocol upgrade aimed at preventing hackers responsible for the recent $1.4 billion Bybit hack from using its platform to launder stolen assets.

“The broad and overwhelming consensus amongst the Chainflip ecosystem is that illicit flows endanger the protocol by exposing LPs to too much risk,” the team said.

The upcoming 1.7.10 upgrade introduces enhanced screening tools that allow broker operators—including platforms like SwapKit and the Rango DEX aggregator—to reject suspicious deposits of ETH and ERC-20 tokens.

The Bybit hack, which occurred on February 21, is now considered the largest crypto heist in history.

Hackers exploited the exchange’s multi-signature approval process by using a fake user interface to conceal a malicious smart contract, ultimately draining a large portion of Bybit’s Ethereum (ETH) reserves.