The hacker responsible for the $1.4 billion Bybit exploit has successfully laundered over 50% of the stolen Ethereum, primarily converting it into Bitcoin through THORChain, according to blockchain analytics firm Spot On Chain.
The firm reported that the attacker had moved approximately 266,309 ETH—worth $614 million—over five days, maintaining a laundering rate of 48,420 ETH daily. At this pace, the remaining 233,086 ETH could be fully laundered within the next five days.
The large-scale operation has caused a surge in THORChain’s transaction volumes. Since February 22, daily activity has risen from an average of $80 million to around $580 million. Over five days, THORChain processed $2.91 billion in transactions, generating $3 million in fees. February 26 saw record-breaking swap volumes of $859.61 million, followed by $210 million on February 27, pushing the two-day total past $1 billion. The incident highlights how decentralized cross-chain platforms are increasingly exploited for illicit fund transfers.
On February 26, the U.S. Federal Bureau of Investigation (FBI) attributed the Bybit hack to North Korean state-sponsored hackers, linking it to the “TraderTraitor” cyberattack campaign that has targeted multiple crypto platforms in recent years.
Despite the attack’s scale, forensic analyses by Sygnia Labs and Verichain confirmed that Bybit’s core security infrastructure remained intact. Investigations revealed the breach originated from a compromised developer machine used for Safe Wallet, a multi-signature solution. Hackers injected malicious JavaScript into the Gnosis Safe UI, enabling access to Bybit’s cold wallet without directly breaching the exchange.
Following the exploit, Bybit announced a $140 million bounty for security researchers and ethical hackers who would assist in recovering the stolen assets. Meanwhile, the exchange purchased 266,700 Ethereum (ETH) worth approximately $742 million over two days, according to blockchain analytics firm Lookonchain.
If you want to read more news articles like this, visit DeFi Planet and follow us on Twitter, LinkedIn, Facebook, Instagram, and CoinMarketCap Community.
“Take control of your crypto portfolio with MARKETS PRO, DeFi Planet’s suite of analytics tools.”
