77% of the ~500,000 ETH stolen in the Bybit hack can still be traced, 20% have “gone into the shadows,” and 3% have been frozen, according to Bybit CEO Ben Zhou.

3.4.25 Executive Summary on Hacked Funds:
Total hacked funds of USD 1.4bn around 500k ETH, 77% are still traceable, 20% has gone dark, 3% have been frozen.
Breakdown:
– 83% (417,348 ETH, ~$1B) have been converted into BTC with 6,954 wallets (Average 1.71 btc each) . This and…
— Ben Zhou (@benbybit) March 4, 2025

417,348 ETH (~$1 billion), or 83% of the total amount, was converted into Bitcoin from 6,954 wallets (averaging 1.71 BTC each).

The current and upcoming weeks are critical for freezing the funds, as the coins will begin to be “cleaned” on exchanges, OTC, and P2P platforms, emphasized Bybit CEO.

The hackers primarily used THORChain to swap Ethereum for Bitcoin.

361,255 ETH or $900 million, accounting for 72% of the losses, passed through a cross-chain protocol that Bybit can monitor.

79,655 ETH (~16% of the funds) were routed through a DEX called ExCH.

40,233 ETH or $100M (~8% of the losses) were sent through the OKX Web3 Wallet proxy.

16,680 ETH from this amount can be tracked by the exchange’s analysts. Information on 23,553 ETH or $65 million (~5% of the assets) is unavailable and will require the involvement of specialists from the mentioned wallet.

Zhou also provided an update on the bounty program.

According to him, 11 participants helped freeze some of the funds. The top executive highlighted the Mantle and Paraswap teams, as well as on-chain analyst ZachXBT. Payouts amounted to $2.18 million in USDT.

Earlier, the FBI confirmed the involvement of the North Korean group TraderTraitor (also known as Lazarus Group, APT38, BlueNoroff, and Stardust Chollima) in the Bybit hack.

Recall that cryptopunk Adam Back called the “flawed EVM design” the cause of the exchange hack.

Later, analysts from Sygnia reported that the incident occurred due to a vulnerability in the Safe infrastructure. Binance founder Changpeng Zhao criticized the wallet developer’s report on the Bybit hack.