Bybit Stolen Bitcoin: $16M Laundered Through Wasabi Mixer to P2P Vendors

In February 2025, Bybit, a prominent cryptocurrency exchange, suffered a massive security breach resulting in the theft of approximately $1.5 billion in Ethereum (ETH). The Federal Bureau of Investigation (FBI) attributed this heist to North Korea’s state-sponsored hacking group, known as the Lazarus Group or “TraderTraitor.”

Following the breach, the stolen assets were swiftly converted, with 86%—approximately 440,091 ETH, valued at $1.23 billion—transformed into Bitcoin (BTC), totalling 12,836 BTC. These funds were subsequently distributed across 9,117 wallets, averaging about 1.41 BTC per wallet. Notably, 193 BTC (approximately $16 million) were laundered through the Wasabi Wallet, a cryptocurrency mixer known for enhancing transaction anonymity, before being funnelled to peer-to-peer (P2P) vendors

How Mixers and P2P Vendors Aid Crypto Laundering

Cryptocurrency mixers, such as Wasabi Wallet, utilise techniques like CoinJoin to enhance transaction privacy. CoinJoin operates by combining multiple Bitcoin payments from various users into a single transaction, making it challenging to determine which spender paid which recipient. This process obscures the transaction trail, thereby protecting user anonymity.

While these services cater to users seeking privacy, they have also been exploited for illicit purposes. By blending coins from different sources, mixers can effectively mask the origin of funds, making it difficult for investigators to trace transactions linked to criminal activities.

The combination of cryptocurrency mixers and P2P platforms presents significant challenges for regulatory authorities and law enforcement agencies. This underscores the need for robust anti-money laundering (AML) measures and regulatory oversight within the cryptocurrency ecosystem to mitigate such risks.

Lazarus Group Suspected Behind Attack

The notorious North Korean hacker group Lazarus is believed to be responsible for the Bybit hack. According to blockchain intelligence firm Arkham, Lazarus now controls 13,400 BTC, with a significant portion traced back to this attack. Bybit’s Latest Data Shows that 88.8% of stolen funds remain traceable, 7.6% have become untraceable, and 3.5% have been successfully frozen. Despite these efforts, Zhou acknowledged that decoding transactions from crypto mixers remains one of the biggest challenges for Bybit’s recovery team.

Chart 1- Published in Albawab, March 20, 2025.

The Future of Crypto Security

As crypto hacks become more sophisticated, exchanges and regulators face growing difficulties in tracking and recovering stolen funds. Bybit’s case highlights the increasing use of mixers and P2P platforms for laundering illicit crypto, raising concerns over the need for stricter monitoring and anti-money laundering (AML) measures. The situation remains fluid as Bybit and blockchain forensic firms continue their efforts to trace and freeze stolen assets. 

Despite these laundering efforts, Bybit’s CEO, Ben Zhou, reported that approximately 88.87% of the stolen assets remain traceable. To date, 3.54% of the funds have been frozen, while 7.59% have been lost to the dark web. The remaining assets are still being tracked, with ongoing efforts to recover them.

This incident underscores the persistent challenges the cryptocurrency industry faces in securing digital assets and combating sophisticated cyber threats. It also highlights the ongoing efforts by exchanges, law enforcement agencies, and blockchain analytics firms to enhance security measures and trace illicit activities within the crypto ecosystem.