Analysis: Bybit hacker's fund flow path is ETH-BTC-fiat, a process that may last years and gradually convert into selling pressure
TechFlow Selected TechFlow Selected
Analysis: Bybit hacker's fund flow path is ETH-BTC-fiat, a process that may last years and gradually convert into selling pressure
The funds are reportedly intended to ultimately support North Korea's nuclear weapons and ballistic missile programs.
Navigating Web3 tides with focused insightsTechFlow news, on February 22, according to analysis by Eric Wall, co-founder of Taproot Wizards, the Bybit hack has been largely confirmed to be carried out by the North Korean hacking group Lazarus Group. According to Chainalysis' 2022 report, this group typically follows a fixed pattern in handling stolen funds, a process that could span several years. Data from 2022 showed that the group still held $55 million worth of funds stolen during their 2016 attack, indicating they are not in a rush to cash out quickly.
Regarding the disposal process of the stolen funds:
-
Step one: Convert all ERC20 tokens (including liquid derivatives such as stETH) into ETH;
-
Step two: Exchange all obtained ETH into BTC;
-
Step three: Gradually convert BTC into Chinese yuan through Asian exchanges;
-
Final use: These funds are reportedly used to support North Korea's nuclear and ballistic missile programs;
The analysis points out that Bybit is currently filling an approximately $1.5 billion ETH shortfall via borrowing, a strategy possibly based on the expectation of recovering the stolen funds. However, given the confirmation of involvement by Lazarus Group, the likelihood of fund recovery is extremely low, meaning Bybit will have to purchase ETH to repay its loans. In the long term, Bybit's ETH purchases may offset against Lazarus Group's ETH sell-offs for BTC conversion, while the BTC acquired by Lazarus Group will gradually translate into selling pressure over the coming years.
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
