Hackers wash most of the stolen bibit code worth $1.4 billion

Hackers who stole around $1.4 billion in cryptocurrency from Crypto Exchange Bybit have driven almost all of their stolen revenues and converted them to Bitcoin.

On February 21, Bybit said that a “sleek attack” on one of its wallets led to the theft of 401,346 Ethereum, worth around $1.4 billion at the time, the largest crypto theft in history and perhaps the biggest robbery. Blockchain surveillance companies and researchers, as well as the FBI, have accused the North Korean government of being behind the hack.

Since the digital robbery, hackers have moved all Ethereum and have stolen from dozens of crypto wallets. They originally split the revenues and converted most of their funds into Bitcoin. Also, Ari Redbord, a former federal prosecutor and global policy director for TRM Labs, a blockchain surveillance company, is Treasurer Secretary.

Andrew Fierman, head of national security information for blockchain monitoring company Chain Dissolving, told TechCrunch that the company tracks about 90% of the stolen Bibit funds. [Bitcoin] It is held at around 4,400 addresses. ”

“The remaining ~10% of the stolen funds were lost due to fees/freezing/off-ramps,” the company said. Off-Ramp is a service that converts crypto into cash.

During this first phase, from February 24th to March 2nd, North Korean hackers took steps to obscure the origins of stolen cryptocurrencies. According to Redbord, hackers did this by relying primarily on Thorswap, a decentralized protocol that allows users to exchange assets across various blockchains “without the need for intermediaries.”

These laundry measures showed “unprecedented levels of operational efficiency” from hackers, Redbord said.

“This rapid laundering suggests that North Korea has expanded its money laundering infrastructure, particularly China’s underground financial network has increased its ability to absorb and process illegal funds,” Redboard said. “The scale and speed of this surgery poses new challenges for investigators as traditional money laundering (AML) mechanisms struggle to deal with the massive amounts of illegal transactions.”

At the same time, Redboard and Robinson said this was just the beginning of the hackers.

“They still have a way to go to profit from these funds,” Robinson told TechCrunch.

For now, Redbord explained that in the second phase, the “first tranches” of stolen funds (now Bitcoin) were deposited into the mixer. A Crypto-mixer (or Tumbler) is a service designed to obscure someone’s cryptocurrency origins and destinations by mixing it with other users’ funds.

“Up to this point, anyone with essentially patience and motivation can follow the Bibit funding flow. But mixers are a huge hurdle for most investigators,” Robinson said.

However, Redbord said that mixers typically receive millions to $10 million a day, so “whether these mixers can continue to absorb the amount they’re playing is an open question.”

In other words, hackers have gotten massive, record loot from Bybit, but it is still unclear how much cash the hackers can convert.

But according to Robinson, they still hope that Bybit will recover some of it.

“At least some of these funds could go through exchanges and potentially freeze,” Redboard said. “It’s just a question of whether these exchanges are aware of the stolen assets quickly enough to handle them.”

After the hack, BYBIT provided a total of $140 million prize money to anyone who could help track and freeze funds. The company said 5% of the recovered funds would be paid to “entities that successfully frozen funds,” while 5% would first report the funds and pay 5% to those who were to freeze them. At the time of this writing, Bybit has only been awarded $4.3 million to 19 bounty hunters, according to the official bounty page.

Bybit did not respond to requests for comment.