Bybit CEO Ben Zhou says 77%+ of the funds stolen remain traceable, including ~417,348 ETH, and 20% have “gone dark”; the hackers converted 83% of the ETH to BTC
Some 417,348 ETH, valued at approximately $1 billion remain traceable on the blockchain after being moved using privacy-focused THORChain.
Context & Ripple Effects
The incident began with reported suspicious outflows after a cold Ethereum wallet was compromised; later coverage characterized it as the largest crypto heist on record.
Tracing efforts have followed the assets across chains: security researchers had already reported large transfers from ETH into Bitcoin through THORChain. The latest accounting clarifies how much of that trail remains available to investigators and counterparties.
First-order effects
- Bybit, blockchain investigators and potential recovery partners can continue monitoring more than three-quarters of the stolen value, including roughly 417,348 ETH, despite its movement through THORChain and into BTC.
- About one-fifth of the funds is no longer traceable, narrowing the set of assets that can be identified, flagged or potentially frozen.
Second-order effects
- Exchanges and other crypto services receiving BTC linked to the theft face greater pressure to screen deposits and act on attribution data, as previous Lazarus-related tracing led to freezes of linked BTC at Binance and Huobi.
- Cross-chain swap routes become a more consequential compliance and security focus: they can speed an attacker’s conversion while still leaving enough public-chain evidence for ongoing tracing.
Third-order effects
- The episode underscores that cross-chain asset mobility does not automatically erase traceability; recovery increasingly depends on how quickly investigators and centralized off-ramps coordinate around on-chain attribution.
- If similarly large thefts continue to transit decentralized swap infrastructure, the industry may face a sustained tension between permissionless liquidity and demands for stronger transaction monitoring at entry and exit points.
The trend: Major crypto thefts are turning cross-chain tracing and coordinated off-ramp controls into core elements of exchange risk management.