The hackers responsible for the theft of approximately $1.4 billion in cryptocurrency from the Bybit exchange have successfully moved the stolen proceeds, converting them into Bitcoin in what experts are calling the initial phase of their money-laundering operation.
Phase 1: Moving and Laundering Stolen Funds
According to reports, the hackers have transferred all the stolen Ethereum out of the various wallets they initially dispersed the funds into and have converted the majority of the proceeds into Bitcoin. Tracking efforts by crypto monitoring firms like Elliptic and Chainalysis have identified around 90% of the stolen funds, with most of them being held in approximately 4,400 Bitcoin addresses. The remaining 10% of the stolen funds have been either lost to fees, freezes, or off-ramped through services that convert cryptocurrency into cash.
Phase 2: Obscuring the Origins of the Funds
During the initial phase of laundering, the hackers utilized THORSwap, a decentralized protocol that facilitates asset swaps across different blockchains without intermediaries, to obscure the origins of the stolen cryptocurrency. This operational efficiency demonstrated by the hackers has posed challenges for traditional anti-money laundering mechanisms, as the high volume of illicit transactions overwhelms investigators.
Future Challenges and Recovery Efforts
As the hackers enter the second phase of their operation, they have deposited an initial portion of the stolen funds – now in Bitcoin – into mixers or tumblers to create doubt in the tracing process for investigators. Although mixers present significant challenges for tracking the flow of funds, their capacity to absorb the large sum of money involved remains uncertain.
Despite the successful laundering of a substantial amount of the stolen funds, there is still a possibility for the recovery of some assets, particularly if exchanges are able to identify and freeze the illicit funds. Bybit has offered a significant bounty for assistance in tracing and freezing the funds, indicating a commitment to recovering the stolen assets. As investigations continue, the outcome of the hackers’ operation and the recovery efforts by Bybit remain uncertain.
