BlockBeats News, April 21st, Bybit CEO Ben Zhou announced in a post the latest update on the March 20th funds theft incident: The total amount of stolen funds reached $1.4 billion (approximately 500,000 ETH). Of this, 68.57% is still traceable, 27.59% is untraceable, and 3.84% has been frozen.

Funds Flow Analysis:

The untraceable funds mainly flowed into a mixer, then were transferred through a cross-chain bridge to P2P and off-exchange trading platforms. Recent observations show that the North Korean hacker group (DPRK) mainly used the Wasabi mixer. After being mixed by Wasabi, a small amount of BTC was transferred to CryptoMixer, Tornado Cash, and Railgun. Subsequently, through platforms such as Thorchain, eXch, Lombard, LiFi, Stargate, and SunSwap, cross-chain exchanges were made. Finally, the funds entered off-exchange trading (OTC) or peer-to-peer (P2P) fiat exchange services.

ETH Movement:

432,748 ETH (84.45%, approximately $1.21 billion) was transferred from Ethereum to BTC via Thorchain. Of this, 67.25% (342,975 ETH, approximately $960 million) was exchanged for 10,003 BTC, dispersed to 35,772 wallets (an average of 0.28 BTC per wallet); 1.17% (5,991 ETH, approximately $16.77 million) remains in 12,490 wallets on the Ethereum chain (an average of 0.48 ETH per wallet).

BTC Movement:

944 BTC (6.34%, approximately $90.62 million) entered the Wasabi mixer; 531 BTC (equivalent to 18,206 ETH, 3.57%) was transferred from the BTC chain back to Ethereum via Thorchain.

Over the past 60 days, 5,443 reports were received, of which 70 were valid, calling for more bounty hunters capable of breaking the mixer to join.