Here's how Bybit hackers moved stolen billions – 28% of the funds have “gone dark”

The latest update from the victim of the largest heist in history, crypto exchange Bybit, has revealed paths used by the criminals to cover their tracks and cash out the stolen money.

According to Ben Zhou, the CEO of Bybit, out of the roughly 500,000 stolen ethereum (ETH), worth $1.4 billion at the time ($813 million today), almost 28% of the funds have “gone dark."

However, the company also claims that after almost 4% of the funds were frozen, the remaining ~69% are still traceable, and investigators are trying to prevent the hackers from cashing out.

Meanwhile, the CEO shared more details on how the North Korean hackers, associated with the state-sponsored Lazarus Group, have been moving the stolen money.

Zhou said that the criminals mainly used the Wasabi wallet, which helps obscure bitcoin (BTC) transaction history via the so-called coinjoin process – mixing BTC from different sources before returning funds without their previous transaction history. On Wasabi, coinjoin operations are run by so-called independent coordinators that are not controlled by the wallet itself.

"After a certain amount of BTC [944 BTC (6.34%, ~$90.62M)] was washed through Wasabi, a small portion of it entered CryptoMixer, Tornado Cash, and Railgun," the CEO continued, referring to other crypto-mixing services dedicated to cryptoassets other than BTC.