Bybit Hackers Swap Stolen ETH for Bitcoin via ThorChain

Bybit Hackers Swap Stolen ETH for Bitcoin via ThorChain

In Summary

  • Bybit hackers moved 209,384 ETH ($480M) onto Bitcoin, mostly via ThorChain
  • FBI confirms North Korea’s Lazarus Group carried out the $1.5B heist
  • ThorChain validators attempted to block laundering but faced technical limits
  • Bybit offers a 5% bounty for freezing the stolen funds


Catenaa, Friday, February 28, 2025-Hackers behind the $1.5 billion Bybit cryptocurrency heist have moved at least 209,384 ETH, worth about $480 million, onto Bitcoin, largely using the decentralized exchange ThorChain, according to blockchain researchers. 

The Federal Bureau of Investigation confirmed that North Korea’s Lazarus Group orchestrated the attack, draining over 400,000 ETH and various tokens from the exchange last week.

Blockchain analytics firm Arkham Intelligence reported that more than $240 million was laundered using ThorChain, with the stolen assets primarily swapped for native Bitcoin. 

Despite efforts by ThorChain validators to block transactions linked to the hack, the platform’s decentralized nature has made intervention difficult.

“This is a national security issue,” said a pseudonymous validator known as TCB, warning that ThorChain could face regulatory scrutiny. 

Bybit has since offered a 5% bounty to any platform or entity assisting in freezing the stolen funds.

However, major decentralized protocols have struggled to prevent illicit transactions, highlighting ongoing challenges in monitoring cross-chain money laundering. 

Protected by Copyscape