rewrite this title Bybit CEO says $1 billion of stolen assets still trackable despite hackers mixing funds with THORchain

Bybit CEO Ben Zhou has confirmed that $1.07 billion—roughly 77% of the assets stolen in the exchange’s recent $1.4 billion security breach—can still be tracked.

In a March 4 update, Zhou disclosed that hackers successfully laundered $280 million, around 20% of the 499,000 ETH stolen.

Meanwhile, investigators have managed to freeze $42 million, accounting for 3% of the compromised funds.

Zhou stated that 11 independent bounty hunters were rewarded $2.1 million for helping to freeze stolen assets. Among the top contributors were Mantle, Paraswap, and blockchain investigator ZachXBT.

THORChain’s role

Zhou revealed that the attackers converted much of the stolen ETH into Bitcoin (BTC) through THORChain, a decentralized platform designed for cross-chain asset swaps.

He stated that the hackers funneled around 83% of the stolen assets—equivalent to 417,348 ETH worth approximately $1 billion—into BTC. They then dispersed these funds across 6,954 wallets, with an average balance of 1.71 BTC per wallet.

This activity significantly boosted THORChain’s transaction volume in the last two weeks to more than $5.8 billion following the Bybit breach. Blockchain analyst EmberCN also reported that the platform earned roughly $5.5 million in fees from these transactions.

Blockchain security researcher Taylor Monahan criticized THORChain, claiming its structure enables criminal activities under the guise of decentralization. She argued that its system operates in an isolated ecosystem that benefits insiders and facilitates money laundering.

Monahan said:

“[THORChain] exists in its own little bubble that’s mostly hard criminals and the insiders who have figured out how to profit from said criminal flows directly or indirectly.”

However, Zhou stated that the funds moved through the platform can still be traced. According to him, it will be critical to freeze the funds in the coming weeks before hackers attempt to cash out through centralized exchanges, over-the-counter (OTC) desks, and peer-to-peer (P2P) networks.

ExCH and OKX involvement

Meanwhile, Zhou also reported that the stolen assets were moved through other platforms, including ExCH and OKX Web3 Proxy.

Zhou disclosed that 40,233 ETH—worth approximately $100 million—moved through OKX’s Web3 proxy. Of this amount, 16,680 ETH remains traceable, while 23,553 ETH ($65 million) requires additional information from OKX to track.

Meanwhile, 79,655 ETH—around 16% of the total stolen—was funneled through ExCH, an exchange that had previously denied facilitating illicit transactions for the Bybit hacker.

In a Feb. 23 statement, ExCH refuted claims that it had laundered funds for North Korea-linked entities but confirmed that:

“[An] insignificant portion of funds from the ByBit hack eventually entered our address 0xf1da173228fcf015f43f3ea15abbb51f0d8f1123, which was an isolated case and the only part processed by our exchange, fees from which we will be donated for the public good.”

Mentioned in this article