Elliptic Warns Stolen Bybit Crypto Headed for Mixers Next

Crypto News Exploits

Lazarus Group's Next Move? Elliptic Warns Stolen Bybit Crypto Headed for Mixers

Written by Aaron S.,

Editor-In-Chief

Last Updated: February 24, 2025

Key Takeaways

Lazarus Group is moving stolen Bybit funds through wallets, DEXs, and mixers to hide their origins;
Elliptic reports at least 10% of the stolen crypto has already been transferred;
Elliptic links exchange eXch to the laundering process, though the platform allows anonymous trading.

Stop overpaying - start transferring money with Ogvio. Sign up, invite friends & grab Rewards now! 🎁

Lazarus Group's Next Move? Elliptic Warns Stolen Bybit Crypto Headed for Mixers

BITDEGREE IN YOUR SOCIAL FEED

The hackers behind the $1.4 billion theft from Bybit $3.31B are likely attempting to cover their tracks by laundering the funds through mixers, according to Elliptic, a blockchain security company.

The firm links the attack to North Korea’s Lazarus Group, a hacking collective known for using similar tactics in past crypto thefts.

Elliptic explained that Lazarus Group typically follows a set process when laundering stolen assets. The first step is usually converting the stolen tokens into a widely used cryptocurrency like Ethereum ETH $3,330.55 .

What is VeChain? VeChain Coin Explainer (ANIMATED)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

From there, the group moves the funds through different methods to hide their origin. These include transferring assets through multiple wallets, swapping them across blockchains, using decentralized exchanges (DEXs), and sending them through crypto mixers like Tornado Cash.

After the Bybit hack, the stolen funds were split into 50 different wallets, each containing around 10,000 ETH. Elliptic reported that these wallets are now being emptied, with at least 10% of the stolen funds already moved.

The firm expects the hackers to use mixing services next, but notes that handling such a large amount of stolen crypto may be difficult.

Elliptic also pointed to eXch as playing a role in the laundering process. The firm claims that tens of millions of dollars worth of stolen Bybit funds have been moved through eXch, which allows users to trade crypto without identity verification.

On February 23, the crypto exchange eXch publicly denied any involvement in laundering funds for the North Korean hackers. What did the exchange say? Read the full story.