Last Friday, the world witnessed one of the largest crypto heists in history, with Bybit losing around $1.5 billion in an attack attributed to the notorious North Korean hacking group, Lazarus. A recent report has revealed that the hacker behind the Bybit attack is now laundering stolen funds through the cryptocurrency exchange eXch, despite the exchange denying such claims just days ago.
Bybit Hackers Laundering Funds using eXch
BeosinTrace tracked the @Bybit_Official hacker transferring assets again at 08:58:23. The new address 0x83c7678492d623fb98834f0fbcb2e7b7f5af8950 began transferring assets on February 24, 2025, at 08:58:23. https://t.co/kKcxTWS4sN pic.twitter.com/2i4mvdRKDq
— Beosin 🛡 Web3 Security & Compliance (@Beosin_com) February 24, 2025
Web3 security firm BeosinTrace reported that it tracked the Bybit hacker making another transfer of stolen assets at 08:58:23 UTC+8 today. According to BeosinTrace, the hacker’s method of laundering funds has become more consistent, primarily using Thorchain to transfer assets to the BTC blockchain, then converting the funds into DAI via the OKX decentralized exchange (DEX). These converted DAI tokens are then sent to eXch.
On February 23, 2025, at 21:37:23 UTC, BeosinTrace identified a transaction originating from the hacker’s address, linked to the Bybit attack (0xfc926659dd8808f6e3e0a8d61b20b871f3fa6465). The funds were sent to settlement addresses and routed through Thorchain:Router.
Today, BeosinTrace revealed that the hacker’s asset transfer was completed at 04:00:02 UTC on February 24, 2025, with the same address, 0xfc926659dd8808f6e3e0a8d61b20b871f3fa6465, being used. The asset laundering process continues to stabilize, with the funds being routed through Thorchain to the BTC chain and then exchanged for DAI on OKX DEX, before flowing into eXch.
eXch Denies Money Laundering
This revelation comes despite eXch’s previous denial of involvement in money laundering. On February 23, the exchange issued a statement claiming, “We are not laundering money for Lazarus/DPRK,” and reassured users that all funds were safe and operations were unaffected by the Bybit hack.
Also Read: Montana House representatives reject Montana Bitcoin reserve bill
