Bybit CEO Ben Zhou has revealed that 88.87% of the $1.4 billion in stolen funds from the exchange remain traceable, but hackers are increasingly using Bitcoin mixers to obscure transaction histories and evade detection.
Current Status of Stolen Funds
As of March 20, 2025, Zhou’s latest executive summary on the stolen funds shows that 86.29% of the stolen assets ($1.23 billion) have been converted into 12,836 BTC and dispersed across 9,117 wallets, averaging 1.41 BTC per wallet. The conversion was primarily carried out through THORChain, a cross-chain liquidity provider that has faced criticism for its reluctance to assist in halting illicit fund transfers. A core THORChain contributor even resigned in protest over the controversy.
Growing Use of Crypto Mixers
Zhou noted that the hackers have started utilizing various crypto mixers to conceal the movement of stolen funds, including:
- Wasabi
- CryptoMixer
- Railgun
- TornadoCash
After being mixed, the funds are further funneled through peer-to-peer (P2P) vendors, making them increasingly difficult to track. Currently, 7.59% of the stolen funds have gone dark, meaning they are no longer traceable. This percentage is expected to rise as more stolen funds pass through mixers.
Frozen Funds and Recovery Efforts
To date, only 3.54% of the stolen funds have been frozen. The first $42.89 million tranche was frozen within a day, thanks to a coordinated effort by Tether, THORChain, ChangeNOW, FixedFloat, Avalanche, CoinEX, Bitget, and Circle. Additionally, Binance and Huobi froze several accounts linked to the stolen assets, following intelligence provided by blockchain analytics firm Elliptic.
Bybit’s Bounty Program and Tracking Website
Alongside fund recovery updates, Zhou disclosed that 63 of the 5,012 bounty reports submitted in the past month have been deemed valid. He emphasized that deciphering mixer transactions remains the biggest challenge in recovering the stolen funds.
To aid in the investigation, Bybit has launched a website that provides live tracking of wallet addresses associated with the stolen funds. Individuals who provide information leading to the freezing of stolen assets will be rewarded with 5% of the frozen amount as part of Bybit’s bounty program.
As the situation evolves, the effectiveness of tracking efforts will depend on overcoming the increasing use of privacy-enhancing technologies by the hackers.
