In a stunning revelation to the historic $1.46 billion Bybit hack that stunned the crypto market on February 21, 2025, new details about the recovery of stolen amounts from the Bybit CEO Ben Zhou are emerging. This follows our previous report about the hack where the hackers exploited the vulnerability within the cold wallet system of the exchange to withdraw approximately 401,000 ETH. As of 4th March 2025, 77% of the hacked amounts are recoverable, 20% are missing, and 3% are under freeze. The hackers also exchanged 83% of the total amounts—in the form of approximately $1 billion of ETH at the time to Bitcoin (BTC), making the recovery process more intricate. This is the latest about this historic robbery and How it will impact the recovery process.
New Breakdown of the Stolen Funds
Since our last report, significant progress has been made in tracking the stolen assets. According to Zhou’s update:
- 77% Traceable ($1.124 Billion): Most of the $1.46 billion take that amounts to $1,124,200,000 is already trackable via the blockchain. The openness gives hope that the funds will be recoverable since Bybit collaborates with the blockchain analysis firms and law enforcement to track the transactions.
- 20% Gone Dark ($292 Million): An astonishing $292,000,000 has gone underground, possibly through the use of mixing services or other anonymizing tools. This amount presents the investigators with a big problem.
- 3% Frozen ($43.8 Million): A small but significant $43,800,000 has been immobilized, possibly through swift action by exchanges or authorities, marking an early win in the recovery process.
These figures align with the total stolen amount, confirming the distribution as efforts to reclaim the funds intensify.
Conversion to Bitcoin: A Strategic Shift
A striking part of the hack was the hackers’ 83% conversion of the stolen ETH to BTC. That amounts to 333,830 ETH, worth approximately $1.21 billion during the period the hack was executed (based upon an ETH valuation of $3,640), though Zhou estimated it to be “around $1 billion” during his announcement, possibly to factor in market movement or rounding. The transfer to Bitcoin, which has been tracked by Kaiko Research, exploits the liquidity and widespread use of BTC, perhaps making the hackers’ laundering or selling easier. But the public nature of the Bitcoin blockchain makes tracking easier if the funds are isolated from sophisticated means such as the use that has made the gone-dark component untraceable.
Progress and Challenges in Recovery
The traceable 77% are the recoverable ones. Companies such as Elliptic and Chainalysis that accused the North Korean Lazarus group of the hack are likely tracking the movement of the funds. Freezing other wallets or recovering through negotiations, such as the 2021 Poly Network hack, where the majority of the stolen cryptocurrency was recovered, are viable options. The 3% that are already frozen are some evidence that this has worked to some degree, but there is limited information about how this was done.
The 20% gone dark does leave a foreboding stumbling block. As our earlier reports indicated, the crypto laundering potential of the Lazarus Group through mixers and cross-border transactions makes recovery that much harder. The conversion to BTC will further complicate the waters, especially if these are included in the gone-dark tally. Cooperation globally will be essential, but the fact that the group has used stolen crypto to fund illicit programs in the past makes the involvement of North Korea, as confirmed through Elliptic, fraught with geopolitics.
Implications for the Crypto Market
This update comes amid broader market volatility, with Bitcoin trading at $83,686 on March 4, 2025, per CoinMarketCap, down 9.72% in 24 hours. The influx of converted BTC from the hack could subtly influence market dynamics, though its scale is modest compared to Bitcoin’s $1.6 trillion market cap. More significantly, the incident reinforces the crypto industry’s security vulnerabilities, prompting renewed calls for enhanced safeguards, as highlighted by Check Point Research in their analysis of the hack’s UI manipulation tactics.
For Bybit users and the wider community, this development underscores the ongoing risks of centralized exchanges. Zhou’s transparency aims to rebuild trust, but the fate of the remaining funds will shape perceptions of the exchange’s resilience. The frozen 3% offers a glimmer of hope, yet the 20% gone dark serves as a stark reminder of the challenges in combating state-sponsored cybercrime.
What’s Next?
As the situation develops, there will be further reports from Bybit about recovery. The future of the trackable funds—frozen, back, or lost forever—will be the test. The new variable introduced through the BTC conversion is something to observe: will the funds pop back up on exchanges or be lost through anonymizing tools? The attribution to the Lazarus Group, an added surprise to our initial report, raises the stakes in the geopolitical arena, which will be how future regulations will be handled.
Investors should be cautious, monitoring words from Bybit and market sentiment. The immediate impact the hack will have on the price of Bitcoin will be minimal, but the ripple that it has on trust and security will be heard ringing months from now. Watch this unfold further.
Find more articles on the MevX Blog!
