Bybit hackers are stepping up their efforts to launder $1.5 billion in stolen bitcoin via multiple mixers and peer-to-peer vendors. The enormous theft, claimed by North Korea's Lazarus Group, took place in February 2025.

CEO Ben Zhou disclosed that hackers exchanged 86% of the stolen funds (440,091 ETH) for 12,836 BTC. These bitcoins were subsequently distributed across 9,117 wallets, with an average of 1.41 BTC per wallet. The hackers now use different mixing services to conceal their tracks, including Wasabi, CryptoMixer, Railgun, and Tornado Cash. Zhou said that 193 BTC ($16 million) had already been routed through mixers, primarily Wasabi. The funds are subsequently transferred to peer-to-peer vendors for additional concealment.

"Decoding mixer transactions is the number one challenge we're facing right now," Zhou said on social media. He expects this trend to pick up as more stolen funds enter mixing services.

Current tracing efforts show that 88.8% of money is still traceable, but 7.6% has become untraceable. 3.5% of all stolen funds have been successfully frozen.

The use of several mixers presents significant hurdles to recovery operations. Each additional layer significantly increases the complexity of subsequent transaction traces. Bybit's bounty program, which was started following the assault, has received over 5,000 reports. So far, just 63 tips have been authenticated as legitimate.

Regardless of the challenges, recovery efforts continue. Bybit is actively seeking cooperation from security experts to decode mixer transactions and track down stolen funds.

The Bybit hack remains the most significant single crypto heist in history. As the situation develops, the crypto community is closely watching to see how exchanges and law enforcement will respond to these advanced laundering strategies.