ZachXBT Tracks $12 Million in Funds from Bybit Hack
Written with artificial intelligence.
ZachXBT has identified a group of addresses associated with over $12 million from the Bybit hack, with Tether freezing 44,200 USDT linked to these addresses. The investigation revealed that the stolen funds, totaling approximately $1.5 billion, have been dispersed across multiple wallets.
Funds Traced from Bybit Hack
ZachXBT has successfully tracked a cluster of addresses holding over $12 million related to the Bybit hack. Tether has frozen 44,200 USDT associated with these addresses, although this action does not guarantee the seizure or return of stolen funds. The total amount stolen in the Bybit incident is reported to be around $1.5 billion (approximately 2 trillion KRW).
ZachXBT utilized insights from private conversations regarding fund movement plans and cross-referenced this information with blockchain transaction records. On March 6, 2025, ZachXBT transferred 349,700 USDC to a new Ethereum address to facilitate a transaction with an intermediary known as 'Jimmy Green.' This transaction represented the principal amount for the investigation, with ZachXBT noting a 5% loss incurred on each trade.
The investigation is set to be publicly disclosed on October 5, 2026. ZachXBT indicated that 'Jimmy Green' had mentioned plans to transfer funds to Solana (SOL), which were subsequently observed the following day. It is estimated that the network of intermediaries involved in these operations has laundered over $1 billion linked to various North Korean cyber hacking incidents. However, the total amount has yet to be independently verified by U.S. government documents.
Despite the tracking and freezing of some funds, it is important to note that identifying address clusters and freezing tokens does not equate to recovering the stolen assets. The U.S. Federal Bureau of Investigation (FBI) previously announced that North Korea was behind the Bybit hack, referring to this operation as 'TraderTraitor.' They warned that the stolen assets have been converted into Bitcoin (BTC) and other cryptocurrencies, then dispersed across thousands of addresses. The investigation highlights the potential of private conversations and intermediary networks to provide clues about fund movements, but recovering stolen funds remains a complex challenge.