ZachXBT continues to investigate the Bybit hack and reveals a complex laundering scheme involving meme coin-related wallets & funds traded for SOL over 920 connected addresses

Blockchain investigator ZachXBT is continuing to map the flow of funds from the February 2025 Bybit exploit, focusing on how a portion of the stolen assets were laundered through a large cluster of meme-coin–related wallets and then swapped into SOL across hundreds of addresses. His latest work builds on earlier attributions of the $1.4–1.5 billion theft to North Korea’s Lazarus Group and complements parallel analyses by firms such as Arkham, Elliptic, and AML Crypto that documented extensive use of cross-chain services and mixers to obfuscate the trail. According to previous public investigations, the Bybit hack involved compromise of infrastructure used for Bybit’s multi-signature Safe{Wallet} setup, allowing attackers to redirect a scheduled cold-to-hot wallet transfer and drain large amounts of staked ETH and ERC-20 tokens. ZachXBT provided early on-chain evidence to Arkham Intelligence that helped attribute the operation to Lazarus, an assessment later echoed in analyses by security firms and in a public advisory from the FBI, which linked the theft to the DPRK’s "TraderTraitor" activity and noted that the attackers were rapidly converting and dispersing assets across thousands of addresses on multiple chains. Subsequent tracing by AML-focused researchers showed that hundreds of attacker-controlled wallets interacted with services like ThorChain, ChangeNOW, and mixers, with a sizeable share of funds swapped into other assets and routed through complex address graphs—patterns consistent with the kind of multi-hop laundering scheme ZachXBT is now detailing around meme coins and SOL. His ongoing mapping of more than 900 connected addresses illustrates both the scale of the laundering infrastructure and the role of retail-facing tokens and cross-chain swaps in breaking forensic links after a major exchange breach. "entities":["ZachXBT","Bybit","Lazarus Group","Arkham Intelligence","FBI","Sygnia","AML Crypto","Elliptic","ThorChain","ChangeNOW","Safe{Wallet}","SOL (Solana)","Ethereum (ETH)","staked ETH","ERC-20 tokens","TraderTraitor","Ben Zhou"]}」}Note: The above appears malformed. Correcting to valid JSON now.`json

✨ AI-generated background, compiled from web sources — not editorial content.

More coverage

• ZachXBT identifies Lazarus group behind $1.4 billion Bybit hack (binance.com)
• ZachXBT - Wikipedia (en.wikipedia.org)
• ZachXBT Uncovers Crypto Theft Network Linked to US Government ... (trmlabs.com)
• Bybit Hack: Inside the $1.4B Theft - AML Crypto (amlcrypto.io)
• The ByBit Heist and the Future of U.S. Crypto Regulation - CSIS (csis.org)

Explore the topic

• Hacks
• SOL
• Memes
• ZachXBT