ChainCatcher news, according to on-chain analyst Yu Jin's monitoring, the 499,000 ETH stolen by the Bybit hacker is finally about to be sold out (today or tomorrow): there are now only 60,000 ETH (approximately 148 million USD) left in the address waiting to be laundered. In the past 24 hours, the Bybit hacker has laundered 96,500 ETH.

According to ChainCatcher's message, on-chain analyst Yu Jin has monitored that since 3 PM yesterday, the Bybit hacker has resumed money laundering activities, having laundered 62,200 ETH (approximately 138 million USD).Currently, of the 499,000 ETH stolen from Bybit, only 156,000 ETH (approximately 346 million USD) remains unprocessed.At the current rate of money laundering, it is expected that the remaining stolen funds will be completely cleared within three days.

ChainCatcher news, according to on-chain analyst Yu Jin's monitoring, the Bybit hacker has suspended the transfer and laundering of ETH since 3 PM yesterday, so only 14,300 ETH (worth about 32.2 million USD) has been laundered in the past 24 hours. Now there are still 218,000 ETH (worth about 486.6 million USD) in the hacker's address.

ChainCatcher news, according to monitoring by Spot on Chain, the Bybit hacker has successfully laundered 50% of the stolen ETH.In the past 5 and a half days, the Bybit hacker has laundered a total of 266,309 ETH (approximately $614 million), accounting for 53.3% of the 499,000 ETH stolen, averaging 48,420 ETH laundered per day, mostly converted to BTC through THORChain. At the current rate, the remaining 233,086 ETH could be fully laundered in just 5 days.

ChainCatcher news, according to on-chain analyst Yu Jin's monitoring, the hacker involved in the Bybit theft incident laundered ETH into BTC through THORChain, bringing THORChain a trading volume of $2.91 billion and $3 million in fee revenue.Data shows that the hacker began the money laundering operation on February 22, contributing a significant amount of transactions to THORChain over a period of 5 days. Prior to this, THORChain's average daily trading volume was about $80 million, which surged to $580 million during the hacker's activity.

ChainCatcher news, according to on-chain analyst Yu Jin's monitoring, in the past 24 hours, the Bybit hacker has continued to launder 71,000 ETH (170 million USD). From the afternoon of the 22nd until now, in 4.5 days, 206,000 of the stolen 499,000 ETH have been laundered. An average of 45,000 ETH per day. There are still 292,000 ETH (685 million USD) remaining in the hacker's address.

ChainCatcher news, according to Cointelegraph, blockchain analysis company Elliptic has discovered that North Korean hackers involved in the Bybit hack control over 11,000 cryptocurrency wallets for money laundering.

ChainCatcher news, according to Beosin tracking, the Bybit hacker has begun transferring assets through the new cross-chain bridge platform Maya Protocol. The hacker address 0xb72334cb9d0b614d30c4c60e2bd12ff5ed03c305 completed the transfer of all assets today at 15:33, and the new address 0x2290937a4498c96effb87b8371a33d108f8d433f started transferring assets at 15:34.

According to ChainCatcher news, monitoring by Ember has revealed that the Bybit hacker has laundered 45,900 ETH (approximately $113 million) in the past 24 hours. The hacker has now laundered a total of 135,000 ETH (approximately $335 million), accounting for nearly one-third of the total stolen funds.The hacker's address still holds 363,900 ETH (approximately $900 million), and at the current rate, it is expected to be fully laundered in the next 8 to 10 days.

ChainCatcher news, according to Spotonchain monitoring, the Bybit hacker has laundered 100,000 ETH (approximately 250 million USD), accounting for 20% of the 490,000 ETH stolen. The hacker is actively dispersing the funds to multiple addresses and using THOR Chain for cross-chain exchanges to BTC, DAI, and other assets.The Bybit hacker still holds 399,000 ETH, a quantity greater than that of Ethereum founder Vitalik Buterin or the Ethereum Foundation.

According to ChainCatcher's message and Ember monitoring, the Bybit hacker has laundered 89,500 ETH (worth approximately $224 million) in the past 2.5 days, accounting for 18% of the total stolen ETH (499,000 ETH). At the current exchange rate, the hacker is expected to convert the remaining 410,000 ETH into other assets (such as BTC, DAI, etc.) within half a month. Currently, the hacker is mainly using THORChain for cross-chain asset exchanges.

ChainCatcher message, Arkham officials stated, "The Bybit hacker makes 2-3 transactions per minute, taking a 15-minute break after every 45 minutes of trading. They transfer ETH from one address at a time, then to the next address. Did the Lazarus Group hire an intern to manually launder money?"

ChainCatcher message, according to lmk.fun (formerly Scopescan) monitoring, the Bybit hacker is using multiple DEXs to exchange ETH for DAI.The hacker has sent 3.64 million USD worth of ETH to another address and is now transferring out DAI.

ChainCatcher message, BeosinTrace has traced the new address of the Bybit hacker 0x96244d83dc15d36847c35209bbdc5bdde9bec3d8 starting to transfer on February 24, 2025, at 14:52:59.The old address 0x83c7678492d623fb98834f0fbcb2e7b7f5af8950 completed the transfer of all assets on February 24, 2025, at 14:57:59.BeosinKYT has tagged these addresses, with the destination addresses mainly being Thorchain and exch. Thorchain and exch are currently still the hacker's preferred money laundering channels.

ChainCatcher message, according to Ember monitoring, there is currently a situation of buyers and sellers in the market. On the seller side, the Bybit hacker has sold 50,700 ETH (approximately $142 million) in exchange for DAI and other on-chain assets (such as BTC, etc.), and currently still holds 448,600 ETH (approximately $1.26 billion). On the buyer side, addresses of Bybit or its affiliates have purchased a total of 157,600 ETH (approximately $441 million) through three brokers: Galaxy Digital, FalconX, and Wintermute in the past two days, and these have been transferred to Bybit.

ChainCatcher message, BeosinTrace tracked that the Bybit hacker transferred assets again at 08:58:23. The new address 0x83c7678492d623fb98834f0fbcb2e7b7f5af8950 started transferring at 08:58:23 on February 24, 2025.The old address 0xfc926659dd8808f6e3e0a8d61b20b871f3fa6465 transferred all assets at 04:00:02 on February 24, 2025.BeosinKYT has tagged these addresses.Currently, the Bybit hacker's cash-out method is stabilizing, mainly using Thorchain to transfer assets to the BTC public chain, and utilizing OKX DEX to exchange for DAI for further circulation. The exchanged DAI will flow into eXch.

ChainCatcher news, on-chain detective ZachXBT disclosed in a personal channel that a certain entity is laundering money for the Bybit hack incident by issuing and trading meme coins on pump.fun.On February 22, the attacker received $1.08 million in funds from the Bybit hack incident through the address "0x363908...d7d1", and then cross-chain transferred USDC to the Solana chain. The entire USDC on the Solana chain was then cross-chain transferred to two addresses on the BSC chain. These two BSC addresses programmatically dispersed the USDC to over 30 addresses before finally consolidating. After that, 106,000 USDC was split into 10 BSC addresses and cross-chain transferred back to 10 Solana addresses. The money launderer exchanged the obtained SOL for meme coins.15 hours ago, on-chain detective ZachXBT publicly revealed over 920 addresses that received funds from the Bybit hack, and discovered that a certain money launderer had issued meme coins for the North Korean hacker organization Lazarus Group through the pump.fun platform. For security reasons, specific wallet addresses are not disclosed at this time, and multiple analysis tools have been requested to take down related interfaces.

According to ChainCatcher's message, monitored by on-chain analyst Yu Jin, the Bybit hacker has used a large number of addresses to utilize cross-chain exchange platforms such as Chainflip, THORChain, LiFi, DLN, and eXch to exchange 37,900 ETH (106 million USD) into other assets (such as BTC) over the past 30 hours since starting to wash coins yesterday afternoon.In addition, the Bybit hacker's address currently holds 461,491 ETH (1.29 billion USD), and the total amount of ETH stolen from Bybit is 499,395 ETH (1.4 billion USD).

ChainCatcher news, Tether CEO Paolo Ardoino posted on the X platform that they have just frozen 181,000 USDT related to the ByBit hack. While it may not be much, it is an effective measure, and Tether will continue to monitor.

ChainCatcher message, on-chain detective ZachXBT posted on social media that the Lazarus Group has just aggregated part of the funds from the Bybit hack with the funds from the Phemex hack directly on-chain, mixing the funds from the initial theft addresses of both incidents.