According to ChainCatcher, Bybit CEO Ben Zhou released the latest execution summary of the March 20 fund theft event: the total stolen funds amounted to $1.4 billion (approximately 500,000 ETH). Among these, 68.57% can still be traced, 27.59% cannot be tracked, and 3.84% have been frozen.
Fund Flow Analysis:
Untraceable funds mainly flowed to mixers, then transferred to P2P and over-the-counter trading platforms through cross-chain bridges. Recent observations show that North Korean hacker groups (DPRK) primarily used Wasabi mixer, and after washing through Wasabi, small amounts of BTC were transferred to CryptoMixer, Tornado Cash, and Railgun, subsequently performing cross-chain exchanges through platforms like THORChain, eXch, Lombard, LiFi, Stargate, and SunSwap. Ultimately, they entered over-the-counter (OTC) or peer-to-peer (P2P) fiat currency exchange services.
ETH Destination:
432,748 ETH (84.45%, approximately $1.21 billion) were transferred from Ethereum to BTC through THORChain. Of these, 67.25% (342,975 ETH, about $960 million) were converted to 10,003 BTC, distributed across 35,772 wallets (an average of 0.28 BTC per wallet); 1.17% (5,991 ETH, around $16.77 million) remained in 12,490 Ethereum wallets (an average of 0.48 ETH per wallet).
BTC Destination:
944 BTC (6.34%, approximately $90.62 million) entered the Wasabi mixer; 531 BTC (equivalent to 18,206 ETH, 3.57%) were transferred back to Ethereum from the BTC chain through THORChain.
In the past 60 days, 5,443 reports were received, with 70 being valid, calling for more bounty hunters capable of cracking mixers to join.
