- Hackers laundered $480M in stolen ETH via ThorChain, swapping assets into Bitcoin through decentralized cross-chain transactions.
- FBI-linked Lazarus Group used DeFi tools like ThorChain and eXch to obfuscate and convert funds at $3.2M/hour.
Hackers associated with the Bybit security breach transferred 209,384 Ethereum (ETH), valued at $480 million, to Bitcoin (BTC) using decentralized cross-chain platforms, primarily ThorChain.
The #Bybit hacker is laundering funds via #THORChain!
So far, the #Bybit hacker has laundered 270K $ETH($605M, 54% of the stolen funds) and still holds 229,395 $ETH($514M). pic.twitter.com/NtcKUpxsxc
— Lookonchain (@lookonchain) February 28, 2025
Ethereum security analyst Taylor Monahan and blockchain analytics firm Arkham Intelligence reported the transactions, which account for over half of the 400,000 ETH stolen from the exchange, alongside 113,000 ETH-pegged tokens.
ALERT: LAZARUS LAUNDERING THROUGH THORCHAIN – MINIMUM $240M SO FAR
Over $240M of ETH has been sent through Thorchain by Lazarus-tagged wallets on Arkham.
These funds have mainly been swapped for native BTC. pic.twitter.com/C1EYtj6aFw
— Arkham (@arkham) February 27, 2025
The U.S. Federal Bureau of Investigation (FBI) attributed the attack to North Korea’s Lazarus Group, a state-sponsored entity linked to multiple cryptocurrency thefts. The group leveraged decentralized finance (DeFi) protocols to obscure transaction trails, converting portions of the stolen ETH into Bitcoin through ThorChain and non-custodial exchange eXch within hours of the breach.
ThorChain, a decentralized exchange (DEX) enabling cross-chain swaps, processed 161,490 ETH ($370 million) across 3,900 transactions. This activity elevated the platform’s daily trading volume to a record $737 million. Validators attempted to block suspicious transfers, but ThorChain’s decentralized governance structure allowed transactions to resume after a consensus reversal.
The Lazarus Group employed advanced laundering tactics, splitting funds across hundreds of wallets and using tools like Asgardex, DeFiSwap, and ShapeShift to execute rapid conversions. Monahan noted the group swapped ETH for Bitcoin at an average rate of $3.2 million per hour.
The incident ignited debate within ThorChain’s community over its role in facilitating large-scale laundering. A pseudonymous developer, Pluto, resigned, citing the platform’s inability to curb illicit activity. Some validators warned that partial centralization could invite regulatory scrutiny, potentially escalating geopolitical risks.
This is how Bybit hack's tracking looks. 💀
and its just track of 2 hops (10 ETH each)my mac air is literally burning to load this txs 🥵 pic.twitter.com/NM2yeyrFyU
— SomaXBT (@somaxbt) February 26, 2025
Bybit announced a 5% bounty for entities assisting in freezing or recovering the assets, reduced from an initial 10%. CEO Ben Zhou clarified the offer applies to exchanges, cross-chain bridges, and mixing services cooperating with investigations.
Recovery efforts face challenges due to the funds’ distribution across thousands of addresses and multiple blockchains, including wrapped ETH derivatives like stETH and cETH. The breach highlights persistent vulnerabilities in decentralized systems, intensifying scrutiny of DeFi’s security framework amid rising institutional adoption.
