THORChain, a decentralized protocol enabling users to swap cryptocurrencies across various blockchains, has seen what can be described as an unwanted windfall after the Bybit hack.

The protocol processed $4.66 billion in swaps in the week ended March 2, the highest tally on record, according to data source DefiLlama. The tally exceeded the $1 billion mark on Sunday alone.

The surge in activity follows the hack of the crypto exchange Bybit on Feb. 22, which saw the North Korean malicious entity walk away with $1.4 billion in ether. Per observers, the entity used THORChain to swap and launder funds, resulting in a record activity on the platform.

“Starting from the initial Bybit Exploiter wallet, funds were sent across a further stretching net of wallets. With each ‘hop’ further from the main wallet, there was an increasing amount of intermediary wallets and the value transfers became smaller and smaller,” blockchain analytics firm Nansen said in a report shared with CoinDesk.

“From hop 2, the hacker started interacting with third-party entities to start swapping and laundering the funds. Entities with the most inflow volume from the hack include THORChain, Paraswap, Mantle, OK DEX and DODO,” Nansen added.

CoinDesk reached out to THORChain for a comment on the matter.

Per onchain analyst EmberCN, hackers have laundered the entire ETH balance in ten days, generating record revenue for THORChain.

“Hackers have laundered all 499,000 ETH ($1.39 billion) stolen from Bybit, a process that took 10 days. The ETH price has fallen by 23% in the process (from $2,780 to $2,130 today). THORChain, the main channel used by hackers to launder money, also earned $5.9 billion in transaction volume and $5.5 million in handling fees due to hackers’ money laundering,” EmberCN said on X.

Market intelligence platform CryptoQuant says that the Ethereum (ETH) reserves of Bybit are recuperating after the crypto exchange was hacked to the tune of $1.4 billion.

In a new thread on the social media platform X, Julio Moreno – CryptoQuant’s head of research – says that Bybit is seeing inflows worth over $390 million in ETH.

“Bybit’s ETH reserves are slowly recovering. The exchange has experienced positive net flows of 139,000 ETH since the hack.”

Previous reports indicate that the Singapore-based exchange suffered the biggest exploit in the digital assets industry when a bad actor took control of its ETH cold wallet, which stores keys offline.

According to recent data from the blockchain tracker Lookonchain, Bybit’s rapid recovery of ETH is being aided by other digital asset firms as well as crypto whales.

“Since being hacked, Bybit has received 145,879 ETH ($390 million) in loans and deposits. Whales withdrew 47,800 ETH ($127.56 million) from Binance to Bybit as loans.

Bitget transferred 40,000 ETH ($106 million) to Bybit as loans. Whale ‘0x3275’ transferred 20,000 ETH ($53.7 million) to Bybit as loans.

[The crypto exchange] MEXC transferred 12,652 stETH ($33.74 million) to Bybit as loans.

Whale ‘0xd7CF’” bought 15,427 ETH ($42.2 million) from CEXs (centralized exchanges) and DEXs (decentralized exchanges), then deposited it to Bybit.

A wallet suspected to be Fenbushi Capital deposited 10,000 ETH ($27 million) to Bybit.”

Furthermore, Lookonchain finds that Bybit itself purchased $197 million ETH via over-the-counter transactions.

Ethereum is trading for $2,808 at time of writing, a 1.5% increase during the last 24 hours.

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Follow us on X, Facebook and Telegram

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Generated Image: DALLE3

Major cryptocurrency exchange Bybit has seen total outflows of over $5.5 billion after it suffered a near $1.5 billion hack that saw hackers, believed to be from North Korea’s Lazarus Group, drain its ether cold wallet.

The total assets tracked on wallets associated with the exchange plunged from around $16.9 billion to $11.2 billion at the time of writing, according to data from DeFiLlama. The exchange is now looking to understand exactly what happened.

In an X spaces session, Bybit’s CEO Ben Zhou revealed that shortly after the incident, he called for “all hands on deck” to serve their clients with processing withdrawals and responding to inquiries about what was going on.

During the session, Zhou revealed that the security breach saw the hackers make off with roughly 70% of their clients’ ether, which meant that Bybit needed to quickly secure a loan to be able to process withdrawals. Yet, Zhou found that ether wasn’t the most withdrawn token, with most users instead withdrawing stablecoin from Bybit.

The exchange, Zhou noted, has reserves to cover these withdrawals, but the crisis deepened as, in response to the incident, Safe moved to temporarily shut down its smart wallet functionalities to “ensure absolute confidence in our platform’s security.”

Safe is a decentralized custody protocol providing smart contract wallets for digital asset management. Some exchanges integrated Safe, which allows users to maintain custody of their funds and has multisig functionality to enhance the security of their cold wallets.

While the exchange had reserves to back up users’ withdrawals, $3 billion worth of USDT was in a Safe wallet that had just been shut down as the wallet moved to understand the situation, according to Zhou.

On social media, Safe said that while it had “not found evidence that the official Safe frontend was compromised,” it was temporarily shutting down “certain functionalities” out of caution.

While Zhou and Bybit’s team were figuring out how to securely withdraw their $3 billion, withdrawals were mounting. Within two hours of the security breach, the exchange was facing requests to move over $100,000 off its platform, Zhou revealed.

Responding to the situation, Zhou told his security team to engage Safe to “find a better way to get this money out.” The team ended up developing new software with code “based on Etherscan” to verify the signatures “on a very manual level” to move the stablecoins back to their wallet and cover the withdrawal surge.

The exchange’s team had to remain up all night to be able to fulfill withdrawals, according to Zhou. As the exchange managed to move the $3 billion in stablecoin reserves, it was facing a bank run of “about 50%” of all the funds within the exchange.

Zhou said that since the incident, the exchange has moved a significant amount of funds off of Safe cold wallets and is now determining what system it will use to replace Safe.

Pushing to “Roll Back” Ethereum Was not Off the Table

Since the security breach, Bybit has engaged authorities. During the session, Zhou said that the Singaporean authorities took the issue “very seriously” and that he believes it has already been escalated with Interpol.

Blockchain analysis firms, including Chainalysis, were engaged. Zhou said, “As long as Bybit is there and continues to track [the stolen ether], I hope we can get these funds back.”

Notably, he revealed that pushing to “roll back” the Ethereum blockchain, which was suggested by some industry players on social media, including BitMEX co-founder Arthur Hayes, had been on the table for some time if the community agreed with it.

“I had my team talking to Vitalik and the Ethereum Foundation to see if there’s any recommendations they can offer to help. I do really thank all these guys on Twitter asking if there is a possibility to roll back the chain. I’m not sure what was the response on their side, but anything that would help we would try,” Zhou said.

When asked if “rolling back” the chain is even possible, Zhou responded he doesn’t know. “I’m not sure it’s a one-man decision based on the spirit of blockchain. It should be a work in process to see what the community wants,” he said.

It’s worth noting that a blockchain “rollback” refers to a state change that would allow for the funds to be recovered. While rolling back the Bitcoin blockchain is technically possible, such a state change on Ethereum would be more complex, given its smart contract interactions and state-based architecture.

Nevertheless, any state change would require consensus and likely lead to a contentious hard fork, drawing criticism from the community. This would likely split the Ethereum blockchain into two networks, each with its own supporters.

As for what exactly caused the hack to occur, is still unclear. Per Zhou, Bybit’s laptops have not been compromised. He said the movements of the transaction’s signers have been scrutinized but appear to have been routine.

“We know the cause is definitely around the Safe cold wallet. Whether it’s a problem with our laptops or on Safe’s side, we don’t know.,” Zhou added.