Crypto exchange data bybit show that $644 million of the $1,4 billion stolen three months ago can no longer be traced. About $693 million (or 49,5%) can still be recovered, and about $63 million (4,5%) is frozen in accounts by the exchange and the authorities.
The stolen funds were systematically laundered through several crypto mixers. The largest portion — almost $247,5 million (about 966 BTC) — was laundered through Wasabi Wallet, and another $94,1 million — through eXch. Smaller amounts went through Tornado Cash ($2,5 million in ETH) and Railgun ($1,7 million in ETH).
The most questionable service is eXch, which publicly announced its closure in April 2025, but continues to operate. TRM Labs analysts confirmed that the crypto mixer still functions through internal APIs.
Transactions on the platform are completely opaque, since all received and sent assets are mixed, and it is impossible to know how many people are hiding behind certain addresses, and tracking is extremely difficult, TRM Labs explained.
Let us recall that shortly after the hack bybit offered a 5% reward to exchanges, protocols, mixers and anyone who helps freeze funds stolen by the North Korean group Lazarus. The company promised to pay these funds immediately after the assets were frozen.
