In late February, Bybit fell victim to a cybersecurity breach that drained over $1.4 billion in digital currency. Nearly three weeks later, on March 20, Bybit founder Ben Zhou released a comprehensive analysis detailing the attack’s mechanics and response protocols.
Bybit Founder Exposes Hack Flows: 86% of Stolen Crypto Traced to 9,117 Bitcoin Wallets
This article was published more than a year ago. Some information may no longer be current.
WRITTEN BY
SHARE
Crypto’s Dark Maze
Zhou revealed that the attacker exploited anonymizing tools—including Wasabi, Cryptomixer, Railgun, and Tornado Cash—to obscure the stolen assets. In a March 20 post on X, he shared critical findings: 88.87% of the funds retained identifiable trails, 7.59% had vanished from detectable pathways, and 3.54% were seized by authorities. A striking detail emerged: 86.29% of the pilfered crypto had been transformed into 12,836 bitcoin, fragmented across 9,117 distinct wallets.
Further analysis showed 193 bitcoins were directed through Wasabi Mixer before dispersal to peer-to-peer (P2P) trading platforms. Zhou stressed the escalating reliance on such tools to conceal illicit flows, calling it a complex obstacle for investigators tracking digital theft. He stated:
Decoding mixer transactions is the [number one] challenge we face now. If you can help, please reach out.
Zhou reported that 5,012 submissions flooded the bounty program over the past month, with only 63 meeting the verification criteria. In a public appeal, he urged greater participation, emphasizing the demand for skilled analysts capable of dissecting mixer transactions. “We welcome more reports, we need more bounty hunters that can decode mixers as we need a lot of help there down the road,” he stated, adding that sustained collaboration will prove vital as efforts to combat crypto theft intensify.
