The Lazarus Group moved 10,000 Ether (ETH), valued at $27 million, to a wallet labeled Bybit Exploiter 54 on Feb. 22 to launder the funds, according to onchain analytics firm Lookonchain.
Onchain data from the firm also shows that the malicious actors, identified by ZackXBT, currently hold 489,395 ETH, valued at over $1.3 billion, and 15,000 Mantle Restaked ETH (cmETH) in 53 additional wallets.
Etherscan also shows that the hacking group has been actively moving funds between the wallets, with over 83 transactions between wallets over the past eight hours.
According to the block explorer, the most recent transaction from Bybit Exploiter 54 was sent to a wallet ending in “CE9” at 01:23:47 PM UTC on Feb. 22 and contained approximately 66 ETH, valued at $182,831.
The $1.4 billion Bybit hack, labeled as the single largest crypto hack in history, shook crypto markets — causing ETH’s price to decline by approximately 8% in a single day and a corresponding dip in altcoin prices.
Related: Bybit exploit exposes security flaws in centralized crypto exchanges
Recovery of the stolen funds begins
Mudit Gupta, the chief information security officer at Polygon, said that roughly $43 million in stolen funds from the hack have already been recovered with help from the Mantle, SEAL, and mETH teams.
Tether CEO Paolo Ardoino added that the stablecoin issuer froze 181,000 USDt (USDT) connected to the hack on Feb. 22.
Bybit also announced a bounty program awarding up to 10% of the stolen funds, valued at up to $140 million, to contributors who help recover the stolen funds from the infamous hacking group.
The exchange garnered widespread praise from industry executives for its communication in the wake of the security incident and for keeping withdrawal requests open for customers during a crisis.
Ben Zhou, CEO of the Bybit exchange, announced that withdrawals have returned to a normal pace after the platform processed all pending withdrawals that created congestion on the exchange following the hack.
The CEO also reassured customers that they could withdraw any amount from the exchange without time delays or issues in a recent social media post.
Magazine: Weird ‘null address’ iVest hack, millions of PCs still vulnerable to ‘Sinkclose’ malware: Crypto-Sec
