Bybit Hackers Launder $1.07B in Stolen ETH to Bitcoin

Edgen Crypto

·Feb 21 2026, 13:31

Share to

Share to

Copy link

Key Takeaways

Attackers who stole assets from the Bybit exchange have laundered the majority of their stolen Ether into Bitcoin using the cross-chain protocol THORChain. Bybit CEO Ben Zhou confirmed that while $1.07 billion in assets remain trackable, the funds have been deliberately fragmented across thousands of wallets to complicate recovery efforts and evade exchange security controls.

Massive Theft: Attackers have laundered funds from a major security breach, with $1.07 billion in stolen assets still being tracked.
Cross-Chain Laundering: Approximately 83% of the stolen Ether was converted into Bitcoin using the THORChain protocol.
Obfuscation Tactics: The laundered Bitcoin was dispersed across 6,954 different wallets to intentionally hinder tracking and blacklisting by exchanges.

Hackers Convert 83% of Stolen ETH to Bitcoin

Bybit is grappling with the aftermath of a major security breach, as attackers have successfully converted approximately 83% of their stolen Ether holdings into Bitcoin. In a statement on February 21, 2026, Bybit CEO Ben Zhou disclosed that the perpetrators used the cross-chain protocol THORChain to execute the large-scale asset swap. This event highlights the growing risk of decentralized finance protocols being exploited for money laundering, allowing illicit funds to move between different blockchains with increased anonymity.

Stolen $1.07B Fragmented Across 6,954 Wallets

The scale of the laundering operation is significant, with an estimated $1.07 billion in stolen assets still considered trackable. The attackers employed a deliberate strategy of fragmentation to obscure the funds' trail, dispersing the newly acquired Bitcoin across a network of 6,954 unique wallets. This long-tail dispersion pattern is designed to overwhelm the screening and risk management systems used by centralized exchanges, complicating efforts to freeze or recover the assets. The incident deals a significant blow to user trust in Bybit and raises concerns about potential selling pressure on the market if the criminals begin liquidating the stolen Bitcoin.