Analysis: The fund flow path of the Bybit hacker is ETH-BTC-fiat, and the process may have lasted for several years, gradually converting into selling pressure
ChainCatcher news, according to an analysis by Eric Wall, co-founder of Taproot Wizards, the Bybit theft incident has been largely confirmed to be the work of the North Korean hacker group Lazarus Group. According to Chainalysis's 2022 report, this organization typically follows a fixed pattern in handling stolen funds, a process that may take years. Data from 2022 shows that the organization still holds $55 million from the 2016 attack, indicating that they are not in a hurry to cash out quickly.The process for handling stolen funds is as follows:Step one: Convert all ERC20 tokens (including liquidity derivatives like stETH) into ETH;Step two: Exchange all obtained ETH for BTC;Step three: Gradually exchange BTC for RMB through Asian exchanges;Final use: It is claimed that these funds will be used to support North Korea's nuclear weapons and ballistic missile programs;Analysis indicates that Bybit is currently supplementing a gap of about $1.5 billion in ETH through borrowing, a strategy that may be based on the hope of recovering the stolen funds. However, given the confirmation that it is the work of the Lazarus Group, the likelihood of recovery is extremely low, and Bybit will have to purchase ETH to repay the loans. In the long term, Bybit's purchase of ETH may offset the actions of the Lazarus Group selling ETH for BTC, and the BTC acquired by the Lazarus Group will gradually convert into selling pressure over the next few years.