{"id":9192,"date":"2025-03-02T07:25:36","date_gmt":"2025-03-02T06:25:36","guid":{"rendered":"https:\/\/wsj-crypto.com\/?p=9192"},"modified":"2025-03-02T07:25:36","modified_gmt":"2025-03-02T06:25:36","slug":"bybit-hackers-renew-laundering-scheme-with-transfer-of-62200-eth","status":"publish","type":"post","link":"https:\/\/wsj-crypto.com\/index.php\/2025\/03\/02\/bybit-hackers-renew-laundering-scheme-with-transfer-of-62200-eth\/","title":{"rendered":"Bybit Hackers Renew Laundering Scheme with Transfer of 62,200 ETH"},"content":{"rendered":"

<\/p>\n

\n

The Lazarus Group of North Korea has laundered an additional 62,200 Ether, valued at $138 million, originating from the Bybit hack on February 21, on March 1 \u2014 with only 156,500 remaining to be transferred, noted a pseudonymous cryptocurrency analyst.<\/p>\n

About 343,000 Ether (ETH<\/a>) out of the 499,000 Ether taken in the $1.4 billion Bybit breach has been relocated, reported<\/a> X user EmberCN, who anticipates the leftover funds will be cleared in the forthcoming three days.<\/p>\n

The 343,000 Ether that has been moved represents 68.7% of the funds that were stolen \u2014 increased from 54%<\/a> as of February 28.<\/p>\n

Previously, EmberCN had indicated<\/a> that laundering activities had diminished due to efforts from the US Federal Bureau of Investigation urging node operators, cryptocurrency exchanges,<\/a> bridges, and others to block transactions associated<\/a> with the Bybit hackers.<\/p>\n

\n

The Bybit hacker still possesses an additional $346 million of Ether to launder, should they decide to do so. Source: <\/em>EmberCN<\/em><\/a><\/p>\n<\/figcaption><\/figure>\n

The FBI has shared 51 Ethereum addresses tied to, or associated with, the Bybit hackers, while blockchain analytics firm Elliptic has identified over 11,000 cryptocurrency wallet addresses<\/a> potentially linked to them.<\/p>\n

Chainalysis, a cryptocurrency forensics firm, stated the hackers had converted segments of the stolen Ether<\/a> into Bitcoin (BTC<\/a>), the Dai (DAI<\/a>) stablecoin, and other assets via decentralized exchanges, crosschain bridges, and instant swap services without implementing Know Your Customer protocols.<\/p>\n

One of those protocols involves THORChain, a crosschain asset swap protocol.<\/a> The developers of this protocol have faced significant criticism for enabling a considerable portion of transfers executed by the North Korean hackers.<\/p>\n

One developer of THORChain, known as \u201cPluto,\u201d mentioned they would cease contributions<\/a> to the protocol after a vote aimed at blocking transactions connected to North Korean hackers was overturned.<\/p>\n

Related:<\/strong><\/em> Bybit hack forensics show SafeWallet compromise led to stolen funds<\/strong><\/em><\/a><\/p>\n

In a correspondence with Cointelegraph, the founder of THORChain, John-Paul Thorbjornsen, stated he no longer has a role in the crosschain protocol, while noting that none of the sanctioned cryptocurrency wallet addresses indicated by the FBI and the Treasury\u2019s Office of Foreign Assets Control<\/a> have interacted with the protocol.<\/p>\n

The $1.4 billion Bybit hack on February 21 stands out as the most significant exploit in the cryptocurrency sector \u2014 more than doubling the losses incurred from the $650 million Ronin bridge compromise<\/a> on March 23, 2022.<\/p>\n

Magazine:<\/strong><\/em> MegaETH launch could save Ethereum\u2026 but at what cost?<\/strong><\/em><\/a><\/p>\n