Only 3.84% Of $1.4 Billion In Hacked Crypto Frozen, ByBit CEO Reveals

Crypto exchange ByBit has disclosed that scarcely one‑twentieth of the assets siphoned off in the sprawling $1.4 billion exploit orchestrated by North Korea’s Lazarus Group are currently locked down. “Only 3.84 percent of the hacked funds are frozen,” chief executive officer (CEO) Ben Zhou revealed via X, warning that the remainder “continues to circulate in an ever‑thickening web of mixers, cross‑chain swaps and over‑the‑counter desks.”

Frozen Crypto Funds? Barely

The exchange’s internal forensic review pegs the original loss at roughly 500,000 ETH, valued at $1.4 billion at the time of theft. Of that total, 68.57% remains traceable, while 27.59% has gone dark—a discrepancy Zhou attributes to “rapid fragmentation and deliberate chain‑hopping designed to frustrate surveillance.”

According to a ByBit executive summary dated 21 April, the untraceable tranche first passed through the Wasabi mixer, with smaller fragments later funneled into CryptoMixer, Tornado Cash and Railgun. The laundered coins then traversed multiple cross‑chain bridges and swap routers—Thorchain, eXch, Lombard, LiFi, Stargate and SunSwap—before disappearing again inside P2P and OTC fiat ramps. “Each hop trims visibility by a few more basis points,” Zhou said, noting that investigators now confront “a labyrinth of tens of thousands of microscopic wallets.”

On the Ethereum side, the firm tracked 432,748 ETH—about 84.45% of the original stack—into BTC via Thorchain. Roughly 67.25% of the initial ETH amount, or 342,975 coins, has already become 10,003 BTC, scattered across 35,772 wallets that average 0.28 BTC each. A residual 5,991 ETH, representing 1.17% of the haul, still sits natively on Ethereum at 12,490 addresses with an average balance below half an ether.

The Bitcoin trail shows a mirror image of the laundering cycle. ByBit found that 944 BTC, or 6.34% of the converted stash, landed in Wasabi. Another 531 BTC—equivalent to 18,206 ETH, or 3.57% —has already been bridged back to Ethereum via Thorchain, underscoring the attackers’ preference for swing‑trading between chains to exploit analytic blind spots.

Investigators working with the crowd‑sourced platform Lazarusbounty.com have attempted to map the dispersion. In the past 60 days the site logged 5,443 bounty submissions, yet only 70 were deemed valid. A notice on the portal pleads for greater public participation: “We welcome more reports; we need more bounty hunters that can decode mixers as we need a lot of help there down the road.”

Despite the daunting numbers, Zhou insists the window for clawbacks has not yet closed. “Roughly two‑thirds of the cryptocurrency is still visible on‑chain, albeit highly fragmented,” he said, adding that further freezes will depend on “coordinated pressure across centralized exchanges, cross‑chain liquidity hubs and even fiat gateways.”

For now, however, the lion’s share of the Lazarus‑linked war chest remains in motion—swapping, bridging and tumbling through the decentralized undergrowth—while the fraction frozen stands at a mere 3.84 percent, a statistic that starkly illustrates how porous the global enforcement perimeter remains against state‑sponsored crypto theft.

At press time, ETH traded at $1,631.