Lazarus Crypto Laundering: Bybit Lessons and Market Impact
The article examines how North Korean-linked Lazarus hackers may launder assets from the reported Binance hack, using the 2025 Bybit theft as a precedent. In that attack, about 500,000 ETH, then worth roughly $1.4 billion, was reportedly converted into BTC within 10 to 12 days. Around 72% of the ETH moved through THORChain, while other routes included eXch and OKX Web3 Wallet. Bybit later said only 3.8% of the stolen funds had been frozen.
The analysis says hackers may favor BTC because it is widely accepted and cannot be frozen by a token issuer. They can then use cross-chain transfers, mixing and underground over-the-counter brokers to exchange crypto for cash or other value, often outside regulated exchanges.
For markets, the main near-term risk is concentrated ETH selling as stolen assets are converted. Subsequent BTC cash-outs may be spread over months and handled off-exchange, limiting direct order-book pressure. The article estimates that about 195,000 ETH, worth around $440 million, in the Binance incident could not be frozen; much of the stolen stablecoins was reportedly frozen. Traders are advised to monitor activity on THORChain and Chainflip for signs of cross-chain conversion. The incident is ongoing, and reported figures may change.
Neutral
The expected market impact is neutral overall, although the incident may create short-lived volatility. The most direct potential pressure is on ETH if hackers convert stolen assets into BTC. In the Bybit case, roughly 500,000 ETH was reportedly converted over about 10 to 12 days, so traders may watch for rising cross-chain activity and ETH selling. The Binance article estimates the unfreezable ETH at about 195,000 coins, worth roughly $440 million—less than the ETH involved in the Bybit theft—and says a large share of the stolen stablecoins was frozen.
The subsequent movement of BTC is less likely to create comparable immediate exchange selling. The article describes laundering through underground OTC brokers, where transactions may be settled off-exchange and spread over time. This can reduce visible order-book pressure, although uncertainty around wallet activity, freezes and potential sales could still trigger risk aversion and short-term price swings.
The Bybit precedent also cautions against attributing broad market declines solely to a hack: ETH fell about 8% on the day of that attack, while the article says later weakness was driven mainly by macroeconomic pressures and leveraged liquidations. In the near term, traders may monitor ETH flows, BTC conversion activity and THORChain or Chainflip volumes, while watching broader liquidity and leverage indicators. Over the longer term, the incident may renew scrutiny of bridge and DeFi security and exchange custody, but the available figures do not by themselves establish a sustained bearish market trend.