How the movement of stolen cryptocurrency works, using the Bybit hack and the investigation associated with North Korean group TraderTraitor—often grouped under the Lazarus umbrella—as a case study.
On February 21, 2025, crypto assets worth approximately $1.5 billion were stolen from Bybit. This was not simply a case of moving the funds from the victim’s wallet to a single address. The attackers had to move an enormous amount of money quickly, change its form, and make it harder to trace.
Thomas Roccia’s presentation focuses primarily on how the hack took place and on the methods criminals use to move funds. Public analyses of the incident add to that picture: in the Bybit case, investigators observed transfers through intermediate addresses, swaps on decentralized exchanges, movement between networks, and conversion of ETH into BTC. The FBI attributed the attack to the North Korean group TraderTraitor. “Lazarus Group” is often used as a broader label for North Korean cyber units, rather than as the precise name of a single team.
First, how the funds were stolen
According to published analyses, the attack did not begin with a direct breach of the blockchain or Bybit’s wallet. Instead, the attackers compromised the Safe{Wallet} supply chain. They gained access to a developer’s working environment and the provider’s infrastructure, then altered the web interface Bybit employees used to prepare a transaction.
The interface showed employees one thing, while the transaction they were signing contained different parameters. This kind of attack is especially dangerous for multisignature wallets: several employees may approve a transaction believing they are reviewing a legitimate transfer. The attack description refers to delegatecall, an Ethereum mechanism that allows a contract to execute another contract’s code in the context of its own state. In this case, a malicious call replaced the wallet’s implementation. The funds were then transferred to addresses controlled by the attackers.
It’s important to distinguish between the theft and the laundering. The funds were stolen by manipulating the transaction preparation and signing process. Moving and laundering the money was a separate phase. These later steps do not erase the blockchain record, but they make the trail longer and harder to analyze.
What “laundering” means in this context
Cryptocurrency does not have to pass through a single specialized service to become harder to trace. Often, laundering means carrying out a sequence of actions: swapping one asset for another, distributing funds, moving them across networks or services, and eventually trying to cash out through intermediaries.
Public analyses of the Bybit case describe several such methods.
1. Quickly converting assets
Stolen tokens can be swapped for more liquid cryptocurrencies. The presentation says that stETH and cmETH were converted into ETH through decentralized exchanges. Such a swap changes the asset, but it does not remove the original transaction: the exchange remains visible on the blockchain and can become a starting point for an investigation.
The criminals’ goal is to move away from a specific token and obtain an asset that is easier to transfer and exchange. For investigators, the swap is a signal to connect the original transfer with subsequent transactions by comparing timing, amounts, and the addresses of the contracts involved.
2. A chain of intermediate wallets
After a theft, funds may pass through many addresses. Each new transfer adds another step to the route and complicates the picture, especially when transactions happen quickly and in parallel.
According to an analysis by the Wilson Center, more than 50 wallets were used in laundering the Bybit funds. Spreading the money this way does not make the transactions anonymous. It increases the amount of work required and may make it harder for automated tools to reconstruct the chain, but all public transfers remain available for analysis.
3. Swaps on decentralized exchanges
DEXs allow users to swap tokens through blockchain protocols, without the familiar centralized process of verifying a customer before each transaction. This can make it easier to move funds quickly and harder to intervene in a specific swap.
But DEX transactions still leave traces: interactions with contracts, swap events, amounts, and timestamps. Analysts use these records to link the asset received to the original transfer and determine where it went next.
4. Moving between blockchains
Cross-chain bridges move value between networks. For investigators, this adds another layer: they need to match an event that locks or burns an asset on one network with the issuance or receipt of the corresponding asset on another.
TRM Labs described the use of intermediate wallets, DEXs, and bridges in the Bybit case. A later analysis also reported that some funds moved through other networks and that a significant portion of the stolen ETH was subsequently converted into BTC. These are findings tied to particular stages of the public investigation, not a definitive, unchanging account of the entire route.
5. Converting ETH into BTC
Later reports on the investigation said that a significant share of the stolen ETH was converted into Bitcoin. This changes the transaction model investigators must analyze: on Ethereum, they typically examine account balances and contract calls; on Bitcoin, they follow individual unspent transaction outputs, or UTXOs.
Changing networks and transaction models makes it harder to connect the activity, but not impossible. Investigators need to trace the asset swap, compare amounts and timing, and then continue the analysis on the Bitcoin network. Public sources also reported the use of mixers and P2P intermediaries in later stages.
6. Mixers and CoinJoin
Mixers and some collaborative transaction schemes are designed to make it harder to determine which incoming funds correspond to which outgoing funds. Analysts may have to consider many possible matches and assess a combination of signals rather than a single transfer.
The presentation describes mixers as one tool in the broader process. But the context matters: TRM noted that the scale of the theft and increased scrutiny of mixers meant the attackers also used rapid transfers through intermediate addresses, DEXs, and bridges. So it would be misleading to reduce the entire route to “sending everything through a mixer.”
7. Intermediaries and cashing out
The ultimate goal is not just to move cryptocurrency, but to make it usable outside the blockchain. At this stage, criminals may turn to OTC brokers, P2P sellers, and exchange services. If the funds reach a regulated exchange, the company may identify their connection to a known theft and freeze them. The outcome depends on the jurisdiction, how quickly the exchange responds, and whether it is willing to cooperate.
The BBC reported that some of the Bybit funds passed through the exchange service eXch. Bybit representatives and experts accused the service of failing to stop the transactions promptly. The service disputed some of those claims and cited uncertainty about the origin of the coins. The episode shows why it is not enough for investigators to identify an address: they also need to quickly notify platforms and get them to act.
The “flood the zone” tactic
One effect of large numbers of rapid transfers is that they can overwhelm investigators with activity to review. When funds pass through numerous addresses, networks, and services, the number of potential connections grows.
TRM Labs described this approach as an attempt to “flood the zone”: increase the speed and volume of transactions enough to complicate the work of compliance teams, investigators, and law enforcement. This does not make transactions disappear. It creates a race against time. Criminals need to move the funds before addresses are added to watchlists and exchanges receive warnings.
How analysts track the money
An investigation typically begins with confirmed addresses associated with the theft—for example, wallets that received the stolen assets. Analysts then reconstruct the transaction chain and look for links between transfers. Any single signal may be ambiguous; the strongest conclusions come from combining multiple indicators.
Timing correlation. Analysts compare transfers and swaps made soon after the theft. If the assets leave the original address almost immediately, are swapped, and then distributed, the sequence can help identify a likely route.
Amount and flow analysis. Investigators examine how amounts change as funds move and are exchanged, which portions take parallel routes, and whether they later converge. They also account for fees, remaining balances, and token transactions.
Contract interaction analysis. It matters not only who sent funds and who received them, but also which contracts were involved in the swap or transfer. Contract events help reconstruct transactions that do not look like simple wallet-to-wallet payments.
Address clustering. Several addresses may be linked by a shared sequence of actions, repeated transaction patterns, or interactions with the same services. A cluster is an analytical hypothesis, not automatic proof that one person controls every address in it.
Tracking cross-chain transfers. When bridges are involved, analysts compare events on both networks: the movement of an asset on the source network and the corresponding receipt on the destination network. Timing and amount matches are especially useful, as are any transaction identifiers provided by the protocol.
Monitoring exchanges and other services. When funds approach a centralized exchange or swap service, analysts share information about suspicious addresses and transactions.
On February 21, 2025, crypto assets worth approximately $1.5 billion were stolen from Bybit. This was not simply a case of moving the funds from the victim’s wallet to a single address. The attackers had to move an enormous amount of money quickly, change its form, and make it harder to trace.
Thomas Roccia’s presentation focuses primarily on how the hack took place and on the methods criminals use to move funds. Public analyses of the incident add to that picture: in the Bybit case, investigators observed transfers through intermediate addresses, swaps on decentralized exchanges, movement between networks, and conversion of ETH into BTC. The FBI attributed the attack to the North Korean group TraderTraitor. “Lazarus Group” is often used as a broader label for North Korean cyber units, rather than as the precise name of a single team.
First, how the funds were stolen
According to published analyses, the attack did not begin with a direct breach of the blockchain or Bybit’s wallet. Instead, the attackers compromised the Safe{Wallet} supply chain. They gained access to a developer’s working environment and the provider’s infrastructure, then altered the web interface Bybit employees used to prepare a transaction.
The interface showed employees one thing, while the transaction they were signing contained different parameters. This kind of attack is especially dangerous for multisignature wallets: several employees may approve a transaction believing they are reviewing a legitimate transfer. The attack description refers to delegatecall, an Ethereum mechanism that allows a contract to execute another contract’s code in the context of its own state. In this case, a malicious call replaced the wallet’s implementation. The funds were then transferred to addresses controlled by the attackers.
It’s important to distinguish between the theft and the laundering. The funds were stolen by manipulating the transaction preparation and signing process. Moving and laundering the money was a separate phase. These later steps do not erase the blockchain record, but they make the trail longer and harder to analyze.
What “laundering” means in this context
Cryptocurrency does not have to pass through a single specialized service to become harder to trace. Often, laundering means carrying out a sequence of actions: swapping one asset for another, distributing funds, moving them across networks or services, and eventually trying to cash out through intermediaries.
Public analyses of the Bybit case describe several such methods.
1. Quickly converting assets
Stolen tokens can be swapped for more liquid cryptocurrencies. The presentation says that stETH and cmETH were converted into ETH through decentralized exchanges. Such a swap changes the asset, but it does not remove the original transaction: the exchange remains visible on the blockchain and can become a starting point for an investigation.
The criminals’ goal is to move away from a specific token and obtain an asset that is easier to transfer and exchange. For investigators, the swap is a signal to connect the original transfer with subsequent transactions by comparing timing, amounts, and the addresses of the contracts involved.
2. A chain of intermediate wallets
After a theft, funds may pass through many addresses. Each new transfer adds another step to the route and complicates the picture, especially when transactions happen quickly and in parallel.
According to an analysis by the Wilson Center, more than 50 wallets were used in laundering the Bybit funds. Spreading the money this way does not make the transactions anonymous. It increases the amount of work required and may make it harder for automated tools to reconstruct the chain, but all public transfers remain available for analysis.
3. Swaps on decentralized exchanges
DEXs allow users to swap tokens through blockchain protocols, without the familiar centralized process of verifying a customer before each transaction. This can make it easier to move funds quickly and harder to intervene in a specific swap.
But DEX transactions still leave traces: interactions with contracts, swap events, amounts, and timestamps. Analysts use these records to link the asset received to the original transfer and determine where it went next.
4. Moving between blockchains
Cross-chain bridges move value between networks. For investigators, this adds another layer: they need to match an event that locks or burns an asset on one network with the issuance or receipt of the corresponding asset on another.
TRM Labs described the use of intermediate wallets, DEXs, and bridges in the Bybit case. A later analysis also reported that some funds moved through other networks and that a significant portion of the stolen ETH was subsequently converted into BTC. These are findings tied to particular stages of the public investigation, not a definitive, unchanging account of the entire route.
5. Converting ETH into BTC
Later reports on the investigation said that a significant share of the stolen ETH was converted into Bitcoin. This changes the transaction model investigators must analyze: on Ethereum, they typically examine account balances and contract calls; on Bitcoin, they follow individual unspent transaction outputs, or UTXOs.
Changing networks and transaction models makes it harder to connect the activity, but not impossible. Investigators need to trace the asset swap, compare amounts and timing, and then continue the analysis on the Bitcoin network. Public sources also reported the use of mixers and P2P intermediaries in later stages.
6. Mixers and CoinJoin
Mixers and some collaborative transaction schemes are designed to make it harder to determine which incoming funds correspond to which outgoing funds. Analysts may have to consider many possible matches and assess a combination of signals rather than a single transfer.
The presentation describes mixers as one tool in the broader process. But the context matters: TRM noted that the scale of the theft and increased scrutiny of mixers meant the attackers also used rapid transfers through intermediate addresses, DEXs, and bridges. So it would be misleading to reduce the entire route to “sending everything through a mixer.”
7. Intermediaries and cashing out
The ultimate goal is not just to move cryptocurrency, but to make it usable outside the blockchain. At this stage, criminals may turn to OTC brokers, P2P sellers, and exchange services. If the funds reach a regulated exchange, the company may identify their connection to a known theft and freeze them. The outcome depends on the jurisdiction, how quickly the exchange responds, and whether it is willing to cooperate.
The BBC reported that some of the Bybit funds passed through the exchange service eXch. Bybit representatives and experts accused the service of failing to stop the transactions promptly. The service disputed some of those claims and cited uncertainty about the origin of the coins. The episode shows why it is not enough for investigators to identify an address: they also need to quickly notify platforms and get them to act.
The “flood the zone” tactic
One effect of large numbers of rapid transfers is that they can overwhelm investigators with activity to review. When funds pass through numerous addresses, networks, and services, the number of potential connections grows.
TRM Labs described this approach as an attempt to “flood the zone”: increase the speed and volume of transactions enough to complicate the work of compliance teams, investigators, and law enforcement. This does not make transactions disappear. It creates a race against time. Criminals need to move the funds before addresses are added to watchlists and exchanges receive warnings.
How analysts track the money
An investigation typically begins with confirmed addresses associated with the theft—for example, wallets that received the stolen assets. Analysts then reconstruct the transaction chain and look for links between transfers. Any single signal may be ambiguous; the strongest conclusions come from combining multiple indicators.
Timing correlation. Analysts compare transfers and swaps made soon after the theft. If the assets leave the original address almost immediately, are swapped, and then distributed, the sequence can help identify a likely route.
Amount and flow analysis. Investigators examine how amounts change as funds move and are exchanged, which portions take parallel routes, and whether they later converge. They also account for fees, remaining balances, and token transactions.
Contract interaction analysis. It matters not only who sent funds and who received them, but also which contracts were involved in the swap or transfer. Contract events help reconstruct transactions that do not look like simple wallet-to-wallet payments.
Address clustering. Several addresses may be linked by a shared sequence of actions, repeated transaction patterns, or interactions with the same services. A cluster is an analytical hypothesis, not automatic proof that one person controls every address in it.
Tracking cross-chain transfers. When bridges are involved, analysts compare events on both networks: the movement of an asset on the source network and the corresponding receipt on the destination network. Timing and amount matches are especially useful, as are any transaction identifiers provided by the protocol.
Monitoring exchanges and other services. When funds approach a centralized exchange or swap service, analysts share information about suspicious addresses and transactions.