The hackers behind the Bybit exchange breach have resumed laundering stolen funds, moving another 62,200 Ether (ETH), worth $138 million, on March 1.
The FBI had previously intervened, warning exchanges, crypto bridges, and node operators to block transactions linked to the hackers. Through blockchain analytics firm Elliptic they identified 51 Ethereum addresses associated with the group and flagged more than 11,000 crypto wallet addresses. The group behind the hack has been linked to North Korea’s Lazarus Group, a notorious state-sponsored hacking group that has previously carried out cyberattacks on various financial platforms.
Despite the efforts to stop the laundering, the hackers have been using decentralized exchanges, cross-chain bridges, and other services to convert the stolen funds into Bitcoin and stablecoins like DAI. One of the platforms used to facilitate the transfers is THORChain, a cross-chain asset swap protocol. This has drawn criticism from some members of the crypto community, leading to a vote on whether to block transactions tied to the hackers. The vote was reversed, which led to one of the protocol's developers, Pluto, leaving the project. THORChain’s founder John-Paul Thorbjornsen clarified that none of the blacklisted addresses have interacted with the protocol, despite the controversy.
The hack, which took place on Feb. 21, is one of the largest in the crypto industry, totaling $1.4 billion in stolen funds. This figure surpasses the $650 million lost in the 2022 Ronin bridge hack. The FBI’s investigation has revealed that the Lazarus Group has been moving the stolen funds across various wallets and assets, attempting to obscure their trail.
As the laundering activities continue, concerns are growing about the effectiveness of current Anti-Money Laundering measures in the crypto space. Authorities remain on high alert, working to track and prevent further illicit transactions. The Bybit breach and its aftermath highlight the challenges of securing digital assets and preventing hackers from moving large sums of stolen funds through the decentralized and largely unregulated cryptocurrency market.