Odaily星球日报讯 ZachXBT 于个人频道发文表示：“Bybit 事件中的 Lazarus Group 转移了 5000 个 ETH 到新地址，并通过 eXch（一个中心化混币器）洗钱，且通过 Chainflip 将资金桥接到比特币。2025 年 2 月 22 日早上 6:28:23 转账 5000 枚 ETH，TXN 为 0xbf80907830e46317da2c1708a13a9f016e242f8a6db6e6b0706ea5f2328cb001；比特币通过 Chainflip 的最终地址为 bc1qlu4a33zjspefa3tnq566xszcr0fvwz05ewhqfq。”

Odaily星球日报讯 ZachXBT 于个人频道发文表示：“Bybit 事件中的 Lazarus Group 转移了 5000 个 ETH 到新地址，并通过 eXch（一个中心化混币器）洗钱，且通过 Chainflip 将资金桥接到比特币。2025 年 2 月 22 日早上 6:28:23 转账 5000 枚 ETH，TXN 为 0xbf80907830e46317da2c1708a13a9f016e242f8a6db6e6b0706ea5f2328cb001；比特币通过 Chainflip 的最终地址为 bc1qlu4a33zjspefa3tnq566xszcr0fvwz05ewhqfq。”

ZachXBT：Bybit黑客已通过混币器及Chainflip将5000枚ETH桥接至BTC网络

Odaily reported that ZachXBT posted on his personal channel stating: "The Lazarus Group involved in the Bybit incident transferred 5000 ETH to a new address and laundered the funds through eXch (a centralized mixer), and then bridged the funds to Bitcoin via Chainflip. The transfer of 5000 ETH occurred on February 22, 2025 at 6:28:23 AM, with the TXN being 0xbf80907830e46317da2c1708a13a9f016e242f8a6db6e6b0706ea5f2328cb001; the final Bitcoin address through Chainflip is bc1qlu4a33zjspefa3tnq566xszcr0fvwz05ewhqfq."

Odaily reported that ZachXBT posted on his personal channel stating: "The Lazarus Group involved in the Bybit incident transferred 5,000 ETH to a new address and laundered the funds through eXch (a centralized mixer) and then bridged the funds to Bitcoin via Chainflip. The transfer of 5,000 ETH occurred on February 22, 2025, at 6:28:23 AM, with the transaction hash 0xbf80907830e46317da2c1708a13a9f016e242f8a6db6e6b0706ea5f2328cb001; the final Bitcoin address through Chainflip is bc1qlu4a33zjspefa3tnq566xszcr0fvwz05ewhqfq."

ZachXBT: Bybit hackers have bridged 5,000 ETH to the BTC network through mixers and Chainflip

Odaily reported that Arkham posted on the X platform, stating that the Bybit bug bounty has been claimed by on-chain detective ZachXBT. ZachXBT submitted conclusive evidence at 3:09 AM Beijing time on February 22, proving that the North Korean hacker group Lazarus Group orchestrated the attack, along with test transaction analysis, related wallet connections, and forensic charts. The report has been submitted to the Bybit team to assist in the investigation. Additionally, ZachXBT commented in the thread that, based on his and CF's Josh's investigation, the Bybit hack is related to the Phemex hack.

The ByBit hack was planned and carried out by the North Korean hacker group Lazarus Group, which is related to the Phemex hack

Odaily reports that ZachXBT posted on his personal Telegram channel that his sources confirm it's a security incident with Bybit. Additionally, ZachXBT warned relevant personnel at major exchanges to blacklist the following EVM addresses: 0x47666fab8bd0ac7003bce3f5c3585383f09486e2, 0xa4b2fd68593b6f34e51cb9edb66e71c1b4ab449e, 0x36ed3c0213565530c35115d93a80f9c04d94e4cb, 0x1542368a03ad1f03d96D51B414f4738961Cf4443. Previously, on-chain sleuth ZachXBT posted on his personal Telegram channel that he had detected suspicious outflows of over $1.46 billion from Bybit, and would provide updates on the related addresses, which is 0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2. mETH & stETH are currently being swapped for ETH on DEX.

ZachXBT: My sources confirm that the Bybit fund outflow was a security incident

Odaily reported that ZachXBT posted again, stating that the Bybit attacker distributed 10,000 ETH to 39 addresses. The report once again reminds exchange and service providers to consider blacklisting and banning the related addresses.

ZachXBT: Bybit hackers have bridged 5,000 ETH to the BTC network through mixers and Chainflip

Download app to participate in rewarding events