Bybit Hack Update: Wasabi Mixer Used To Launder $16M in Stolen Bitcoin

Bybit Hack Update: Hackers behind the $1.5 billion Bybit cryptocurrency theft have started laundering stolen bitcoin through mixing services and peer-to-peer (P2P) vendors. Bybit CEO Ben Zhou confirmed that 193 BTC, valued at $16 million, were funneled through the Wasabi mixer before being distributed across various P2P networks.

Hackers Convert Stolen Ether to Bitcoin

Following the February 2025 Bybit hack, hackers exchanged 86 of the stolen funds for ether to Bitcoin. Bybit CEO Ben Zhou said that the amount of 440,091 ETH, equivalent approximately to $1.23 billion, was swapped for 12,836 BTC.

The received Bitcoin was then divided into 9,117 wallets, with an average balance per wallet of 1.41 BTC.

Cross-chain liquidity protocols such as THORChain have been identified as the principal means through which the conversion occurred. This method enables users to interchange assets between different blockchains without dealing with centralized exchanges.

Use of Mixers to Obscure Fund Movements

Bybit CEO Ben Zhou said that while the hackers are suspected to be from the North Korean Lazarus Group, they have been trying to wash the stolen Bitcoin through several mixers. Some of the presently available mixers are Wasabi, CryptoMixer, Railgun, and Tornado Cash. The main purpose of using a mixer is to hide the history of the transactions to ensure that the traces cannot be followed.

“Decoding mixer transactions is the problem which is on the top of the list,” said Bybit CEO Ben Zhou for X. He further noted that the laundering activity will continue to rise with more funds being channeled through these services.

Wasabi is a Bitcoin mixing service that introduced the CoinJoin technique which unites several transactions into one to increase anonymity. This way, blockchain investigators are unable to easily trace movements of funds by an individual.

Bybit Hack Stolen Funds Moving to Peer-to-Peer Vendors

After passing through mixers, the stolen Bitcoin is being sent to P2P vendors. These vendors facilitate direct transactions between individuals without requiring intermediaries.

Since P2P trading often bypasses centralized oversight, it adds another layer of complexity to tracking and recovering stolen assets.

According to Bybit, 88.8% of the stolen funds remain traceable, while 7.6% have become untraceable due to laundering efforts. Additionally, 3.5% of the funds have been successfully frozen through cooperation with industry partners.

Bounty Program to Track Stolen Assets

Post the Bybit hack, the exchange launched a bounty program to incentivize individuals and organizations to help trace and freeze the stolen funds. The program has allocated a total of $140 million in rewards, with $2.2 million already awarded. The bounty is structured to provide 10% of any recovered funds, with half going to the entity that successfully freezes them and the other half to the first reporters who contribute to the freezing process.

In the past 30 days, Bybit received 5,012 bounty reports, of which 63 were deemed valid. Bybit CEO Ben Zhou emphasized the need for more experts who can analyze mixer transactions and track stolen funds.

Data from Arkham Intelligence suggests that the Lazarus Group currently holds 13,400 BTC, much of which is linked to the Bybit hack. Investigators continue monitoring these assets while working with exchanges and blockchain analytics firms to prevent further laundering.