Hackers convert $1.4 Billion stolen from Bybit into Bitcoin

In what has been described as the largest cryptocurrency theft in history, hackers who stole approximately $1.4 billion from the crypto exchange Bybit have moved nearly all the stolen funds into Bitcoin. Experts have indicated that this marks the first phase of a sophisticated money-laundering operation, with the funds now dispersed across thousands of addresses.

On February 21, Bybit confirmed that a “sophisticated attack” had targeted one of its wallets, resulting in the theft of 401,346 Ethereum, worth an estimated $1.4 billion at the time. The heist has since been labeled the largest cryptocurrency theft ever, potentially surpassing any other heist in terms of value. Blockchain researchers, along with the FBI, have linked the attack to North Korean hackers, known for their involvement in cybercrimes related to cryptocurrency.

Since the attack, blockchain monitoring firms, including Elliptic and TRM Labs, have traced the stolen funds as they were moved through multiple wallets. According to Tom Robinson, co-founder of Elliptic, and Ari Redbord, global head of policy at TRM Labs, nearly all of the stolen Ethereum has been converted into Bitcoin. As of early March, experts report that approximately 90% of the stolen funds are being held across roughly 4,400 Bitcoin addresses.

Andrew Fierman, head of national security intelligence at Chainalysis, a blockchain monitoring company, confirmed that the movement of these funds was being closely tracked. He noted that the remaining 10% of the stolen cryptocurrency had either been lost due to transaction fees or had been converted into cash through off-ramp services—platforms that facilitate the exchange of cryptocurrency for traditional currency.

Between February 24 and March 2, the hackers employed a range of tactics to obscure the origin of the stolen funds. One of the key methods they used involved THORSwap, a decentralized protocol that allows users to swap assets across different blockchains without the need for intermediaries. This approach helped the hackers further cover their tracks, making it more difficult to trace the movement of the funds.

Experts have praised the hackers for their “unprecedented level of operational efficiency” in carrying out the laundering operation. This development highlights the growing sophistication of cybercriminals and the ongoing challenges in tracking illicit cryptocurrency activities.

As investigations continue, the FBI and blockchain monitoring firms are working to trace the stolen assets and prevent the further laundering of the funds. The breach serves as a stark reminder of the vulnerabilities in the cryptocurrency industry, with many questioning the security protocols of exchanges like Bybit moving forward.