• The Lazarus Group has successfully laundered $1.5 billion stolen from Bybit, converting Ethereum to Bitcoin using THORChain’s decentralized exchange.

• Despite facing criticism, THORChain emphasized its commitment to decentralized finance principles, arguing that it is not in the role of law enforcement.

• “Lazarus has now fully laundered the proceeds of the Bybit hack,” reported Arkham Intelligence, challenging the security of decentralized platforms.

This article explores the implications of the Lazarus Group laundering $1.5 billion from Bybit through THORChain, raising questions on decentralized finance security.

Lazarus Laundered Bybit’s Money

According to recent reports by Arkham Intelligence, a blockchain analytics firm, the notorious Lazarus Group has completely laundered the stolen funds from the Bybit hack that occurred on February 21, 2025. The group leveraged THORChain’s decentralized exchange (DEX) to convert over 500,000 ETH into Bitcoin, raising significant concerns regarding the operational integrity of decentralized finance protocols.

Arkham’s social media update noted, “Lazarus has now fully laundered the proceeds of the Bybit hack. They have transferred 500,000 ETH mainly to native BTC. THORChain has processed over $5.5 billion in volume since Bybit was hacked.” This incident is recognized as one of the largest security breaches in crypto history, with an astonishing $1.5 billion in ETH stolen.

Bybit’s CEO, Ben Zhou, disclosed that over 83% of the stolen assets had been converted into Bitcoin within days of the attack, underscoring the rapidity of Lazarus Group’s operations. Crypto analysts confirmed that the group has efficiently laundered a staggering 72% of all stolen assets through THORChain.

THORChain’s trading volume surged following the hack, demonstrating the extent of activity generated by the laundering operations. While the platform facilitated these transactions, it also raked in approximately $3 million in fees from them, highlighting the inherent financial incentives tied to transaction volumes.

THORChain Volume Spikes After Bybit Laundering. Source: DeFi Llama

Amid the criticism, users have directed ire towards THORChain for allegedly failing to prevent the laundering activities, suggesting that the validators could have intervened. On the contrary, THORChain proponents contend that the platform is a decentralized, open-source entity that operates autonomously, distancing itself from regulatory burdens.

“The only reason why people feel that THORChain should censor transactions is the general feeling that if they put enough pressure on Node Operators, they will buckle under pressure,” remarked Runemir, Chief Narrative Officer at Qi Capital. He emphasized the necessity for THORChain to engage in narrative battles to mitigate the fallout from such incidents.

Debate on Decentralized Finance Integrity

This contentious situation sheds light on the vulnerabilities present within decentralized institutions. While THORChain serves as a conduit for unregulated transactions, the implications of its facilitation of substantial laundering activities could tarnish its reputation and that of decentralized finance as a whole.

In principle, if groups like Lazarus can exploit these platforms without oversight, significant questions arise regarding the viability of decentralized finance models. Critics argue that this reflects a systemic flaw, hinting that the effective functioning of such networks may inherently enable financial crimes.

Conversely, THORChain’s defenders argue that attributing fault to the platform disregards the responsibilities of users who engage with decentralized exchanges. The frenetic activity surrounding the RUNE token, which saw brief spikes in value before settling, serves to illustrate the volatile undercurrents in decentralized markets.

The aftermath of the Bybit laundering saga will likely resonate within the crypto community for years, as stakeholders grapple with the duality of decentralized finance’s aspirational values versus its operational reality.

Conclusion

The laundering of $1.5 billion by the Lazarus Group through THORChain underscores the critical challenges facing decentralized finance infrastructures. While the technological innovations of such platforms are transformative, their capacity to facilitate illicit activities presents serious implications for stakeholder trust and regulatory discourse. As the crypto landscape evolves, the lessons learned from this incident may shape future governance frameworks and operational protocols within decentralized systems.