Lazarus Group's Next Move? Elliptic Warns Stolen Bybit Crypto Headed for Mixers

The firm links the attack to North Korea’s Lazarus Group, a hacking collective known for using similar tactics in past crypto thefts.

Elliptic explained that Lazarus Group typically follows a set process when laundering stolen assets. The first step is usually converting the stolen tokens into a widely used cryptocurrency like Ethereum ETH $2,675.23 .

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

What Are Crypto Rollups? ZKSnarks vs Optimistic Rollups (ANIMATED)

SUBSCRIBE

ON YOUTUBE

From there, the group moves the funds through different methods to hide their origin. These include transferring assets through multiple wallets, swapping them across blockchains, using decentralized exchanges (DEXs), and sending them through crypto mixers like Tornado Cash.

After the Bybit hack, the stolen funds were split into 50 different wallets, each containing around 10,000 ETH. Elliptic reported that these wallets are now being emptied, with at least 10% of the stolen funds already moved.

The firm expects the hackers to use mixing services next, but notes that handling such a large amount of stolen crypto may be difficult.

Elliptic also pointed to eXch as playing a role in the laundering process. The firm claims that tens of millions of dollars worth of stolen Bybit funds have been moved through eXch, which allows users to trade crypto without identity verification.

On February 23, the crypto exchange eXch publicly denied any involvement in laundering funds for the North Korean hackers. What did the exchange say? Read the full story.