Stealing $1.5B From Bybit Was Easy. Cashing Out Is the Nightmare.

The Heist Was Never the Hard Part

What actually happens to $1.5 billion in stolen crypto? That's the question nobody asked after the Bybit hack. Everyone covered the breach. Almost nobody tracked the exit.

Here's the thing. Stealing crypto is a solved problem now. Cashing out isn't. North Korea's Lazarus Group has lifted billions over the years, and it still can't spend most of it faster than investigators can follow it. The chain doesn't lie, anon. Every hop leaves a mark.

The Raw Numbers

On Feb. 21, 2025, hackers drained roughly 401,000 ETH from Bybit's cold wallet. About $1.5 billion at the time. The FBI pinned it on TraderTraitor, the Lazarus unit that also hit Ronin and Harmony.

Bybit's response was fast. Clients got made whole. The exchange processed around $4 billion in withdrawal requests in the first 10 hours and didn't break. That's the part people forget.

Then the laundering started, and it got messy. Bybit put a 10% bounty on the table, up to $140 million, for anyone who helped freeze or return the funds. eXch, a no-KYC exchange in the EU, processed roughly $35 million of the loot before pressure forced it to wind down. It shut its doors in May 2025, and a suspect got arrested in the Netherlands.

THORChain processed billions in cross-chain swap volume in the days after. Zcash saw a spike too. Every one of those rails is a receipt.

Why the Exit Is the Trap

North Korea can steal at industrial scale. It can't spend at industrial scale. Real talk: moving nine figures of tainted ETH needs an entire network. Mixers, instant swappers, over-the-counter desks, brokers in Shenzhen, people willing to touch dirty coins for a cut.

That's the chokepoint. On-chain analyst ZachXBT spent weeks mapping that network. His point was simple. The hack is one transaction. The cash-out is thousands of human relationships, and every one of them is a place where someone can flip.

Historically, less than 1% of stolen crypto ever gets recovered. That stat cuts both ways. The thieves usually keep the money. But they keep it stuck, frozen in wallets they can't move without tripping alarms.

Chainalysis and TRM Labs flagged the same pattern. Lazarus had to slow-roll. A few million here, a few million there. No clean sweep. That's not a victory lap. It's a prison.

What to Watch Next

First, watch swap volumes on THORChain and other cross-chain venues. Any sudden spike in ETH or mETH flows is a tell. Second, watch the Dutch prosecution of the eXch operator. If it sticks, it's a warning shot at every no-KYC venue still washing tainted coins. Third, watch the Bybit bounty payouts. If that $140 million actually gets distributed, the incentive math changes for the next insider who's offered a cut.

And watch the wallets themselves. Roughly 77% of the stolen funds were still traceable months later, according to blockchain analysts. That number either shrinks as the money moves, or it sits there like a ticking clock.

I've been saying this for weeks. The next wave of DeFi security won't come from better code. It'll come from better exits. Because you can lift $1.5 billion in a single afternoon, but you can't spend it without leaving a trail that stretches across every chain, every bridge, and every shady OTC desk in Asia.

North Korea is learning the same lesson every degen learns eventually. Getting the bags is easy. Getting out is the whole game.