Lazarus Group ‘Launders’ $1.5B Bybit Hack Funds Using THORChain DEX

The North Korean-affiliated Lazarus Group has allegedly fully laundered funds stolen in the recent Bybit hack, transferring 500,000 Ethereum (ETH) primarily into Bitcoin (BTC). Blockchain security analysts identify Lazarus Group as the main suspect behind the attack.

Blockchain security firm Arkham Intelligence reported that THORChain, a decentralized cross-chain liquidity protocol, has processed over $5.5 billion in transaction volume following the February 21 Bybit hack. 

LAZARUS HAS NOW FULLY LAUNDERED THE PROCEEDS OF THE BYBIT HACK

They have transferred 500,000 ETH mainly to native BTC.

Thorchain has processed over $5.5B in volume since Bybit was hacked on the 21st February. pic.twitter.com/JmoW4AkXD2

Bybit Co-founder and CEO, Ben Zhou, shared in a post on X that the hackers primarily utilized THORChain to convert ETH into BTC  following the breach. 

3.4.25 Executive Summary on Hacked Funds:
Total hacked funds of USD 1.4bn around 500k ETH, 77% are still traceable, 20% has gone dark, 3% have been frozen.
Breakdown:
– 83% (417,348 ETH, ~$1B) have been converted into BTC with 6,954 wallets (Average 1.71 btc each) . This and…

Despite surpassing $5 million in revenue, the THORChain protocol has come under scrutiny for its involvement in processing illicit transactions. On February 28, a developer known as “Pluto” resigned after a decision to block transactions linked to North Korean hackers was overturned.

**Moving on from THORChain**

Validators, developers, members of the community: effectively immediately, I will no longer be contributing to THORChain. I will remain available to Nine Realms as long as I am needed and to ensure an orderly hand-off of my responsibilities. It has…

On March 4, crypto commentator Yogi alleged in a post on X that THORChain played a role in laundering $605 million linked to North Korea. “No KYC, no off switch, no resistance. Lazarus Group hacked Bybit for $1.5 billion in February 2025, then funneled the stolen ETH through THORChain like it was built for them. Over five days, $2.91 billion in volume ripped through, $860 million in a single day, while THORChain pocketed $3 million in fees. That’s not innovation—that’s negligence at best, greed at worst,” Yogi wrote. 

THORChain just helped North Korea launder $605 million. No KYC, no off switch, no resistance. Lazarus Group jacked Bybit for $1.5 billion in February 2025, then funneled the stolen ETH through THORChain like it was built for them. Over five days, $2.91 billion in volume ripped… https://t.co/LKtGFFsZaM

However, supporters of THORChain argue that, as an open-source and decentralized protocol, it operates independently and does not function as a law enforcement entity. “The only reason why people FEEL that Thorchain should censor transactions is the general FEELING that if they put enough pressure on Node Operators, they will buckle under pressure (which honestly can happen),” wrote Runemir, Chief Narrative Officer of Qi Capital, in an X post.

The only reason why people FEEL that Thorchain should censor transactions is the general FEELING that if they put enough pressure on Node Operators, they will buckle under pressure (which honestly can happen).

Nobody is asking that from Bitcoin and Ethereum because it FEELS…

“Nobody is asking that from Bitcoin and Ethereum because it FEELS impossible,” he added.

Bybit Tracks Stolen Funds Linked to Lazarus Group with Community Help

The Bybit CEO shared that 77% of the stolen funds remain traceable, while 20% are unaccounted for, and 3% have been frozen.

Zhou disclosed that 417,348 ETH, valued at $1 billion, has been converted into Bitcoin (BTC) across 6,954 wallets, averaging 1.71 BTC per wallet. He also noted that 361,255 ETH, or $900 million (72%), was processed through THORChain, with transactions remaining traceable.

Furthermore, Zhou reported that 40,233 ETH, valued at $100 million (8%), was moved through the OKX Web3 proxy. Of this, 16,680 ETH remains traceable, while 23,553 ETH ($65 million or ~5%) is currently untraceable and would require additional data from OKX Web3 Wallet to track.

Eleven entities assisted Bybit in freezing the stolen funds, with Mantle, Paraswap, and ZachXBT playing key roles. A total of $2,178,797 USDT has been distributed to 11 bounty hunters for their contributions.

Bybit has introduced a tracking website to monitor the movement of its stolen funds and is offering a bounty to those who assist in freezing them.

So far, the platform has identified seven exchanges cooperating in the effort, while one—eXch, a no-Know Your Customer (KYC) swap service—has refused to freeze assets connected to the hack. 

Read More

Michaela has no crypto positions and does not hold any crypto assets. This article is provided for informational purposes only and should not be construed as financial advice. The Shib Magazine and The Shib Daily are the official media and publications of the Shiba Inu cryptocurrency project. Readers are encouraged to conduct their own research and consult with a qualified financial adviser before making any investment decisions.