727 FinanceReviewing the Bybit case, how hackers converted 500,000 ETH into BTC in 10 days, revealing the full process of cross-chain coin laundering and underground OTC cash-out. ETH selling pressure was concentrated, BTC impact was limited, and hackers were not the main cause of the major drop.
Author: SoSoValue Research
On the evening of October 29, Binance suffered what is suspected to be the largest hacker attack in history. Chainalysis estimates the stolen amount at approximately $5.9 billion, and on-chain detective ZachXBT believes it was most likely carried out by North Korea's Lazarus.
Many people are concerned: how will the hackers handle these coins? Will they dump them? To answer this question, the best reference is the Bybit case carried out by the same group in February 2025.
I. Reviewing Bybit: 500,000 ETH, all converted to BTC within 10 days
On February 21, 2025, approximately 500,000 ETH was stolen from Bybit, worth about $1.4 billion at the time, making it the largest cryptocurrency theft in history up to that point.
The hackers moved very quickly:
● Day 1: First converted staking derivatives such as stETH and mETH into native ETH, then split it across a large number of addresses.
● Day 5: At least 160,000 ETH had already been transferred cross-chain via THORChain.
● Day 9: Another 62,200 ETH was transferred in a single day, bringing the cumulative total to approximately 343,000 ETH moved.
● Days 10–12: Arkham confirmed that approximately 500,000 ETH had all been bridged from Ethereum into native BTC.
Which channels were used?
● THORChain (decentralized cross-chain protocol): about 72%, 361,000 ETH
● eXch (no-KYC exchange platform): about 16%, 79,700 ETH
● OKX Web3 Wallet: about 8%, 40,000 ETH
THORChain thus earned about $5.5 million in fees, drawing strong criticism from the community. eXch later announced its shutdown on May 1, 2025.
How much could ultimately be recovered? Two months later, the Bybit CEO published figures showing that 68.6% remained traceable, 27.6% had "disappeared," and only 3.8% had been frozen.
Conclusion: Nearly all of the stolen ETH was converted into BTC, and less than 4% was actually recovered.
II. Why must hackers convert to BTC?
1. No one can freeze it
2. USDT and USDC have issuers that can blacklist addresses at any time. In this Binance incident, Tether and Circle quickly froze about $2.4 billion in stablecoins. ETH itself cannot be frozen, but DEXs, lending protocols, and cross-chain bridges in the Ethereum ecosystem may all block it. There are no such "checkpoints" on the Bitcoin chain.
3. Deepest liquidity and highest acceptance
4. Any off-exchange dealer anywhere in the world accepts BTC. MIT Technology Review pointed out as early as 2020 that hackers ultimately tend to return to Bitcoin because no other coin is so widely accepted or so easy to convert into cash.
5. Suitable for long-term storage
6. Lazarus is a state-level hacker organization and is not in a hurry to use the money. BTC can be held for months or even years, waiting for the heat to die down before cashing out in batches.
III. After converting to BTC, how is it cashed out?
The answer is: cashing out through underground OTC (over-the-counter) dealers.
The U.S. Department of the Treasury points out that North Korea typically uses off-exchange dealers to convert stolen crypto assets into traditional currency, and most of these dealers are in China, avoiding the sight of financial institutions and regulators.
The general path:
Stolen ETH → bridged into BTC → split and mixed → often converted into USDT on the Tron chain → underground dealers → fiat currency or value in kind
How do dealers "break the chain"? Through "mirror trades."
Dealers simultaneously have another group of buyers who need cryptocurrency but do not care about its source, such as people trying to move funds abroad, online gambling and fraud platforms, and gray-market cross-border trade. The dealer sells the hackers' coins to these people, then hands the local fiat currency paid by these people to the people designated by the hackers. On-chain tracing ends at the dealer, while the off-chain money comes from completely unrelated parties.
Where does the fiat currency ultimately end up? Public cases include:
● Bank accounts and UnionPay cards. A report by the Multilateral Sanctions Monitoring Team (MSMT) pointed out that North Korea's cyber forces have used China's financial system, including UnionPay credit cards and commercial banks, to cash out stolen crypto assets.
● Gift cards. Two Chinese nationals indicted by the U.S. Department of Justice in 2020 were accused of converting North Korea's coins into RMB or Apple gift cards to cash out.
● Gray financial platforms in Southeast Asia, such as Cambodia's Huione Group.
● Regions involved include China, Russia, Argentina, Cambodia, Vietnam, the UAE, and others.
IV. "Can't flagged BTC not enter exchanges?"
This is the most common question. The answer has three points:
1. Dirty coins do not need to enter compliant exchanges at all. They are sold to buyers in the gray economy, who use the coins for continued circulation and settlement and will not deposit them into Binance or Coinbase.
2. Flagging is not a permanent "black-and-white" label but a risk score. After multiple layers of relay, mixing, and blending with other funds, tracing shifts from "certain" to "probabilistic." This is why 27.6% of the funds in the Bybit case "disappeared."
3. Dealers cover risk with high fees. Dealers know it is dirty money and charge fees far above normal levels. Wallets, bank cards, and shell companies are replaced after use, and the risk of sanctions and freezing is all priced in.
Of course, this path also has costs: mixing fees, cross-chain fees, dealer discounts, and frozen portions may result in considerable losses. But for a sanctioned country with almost no other source of foreign exchange, recovering half is still a huge gain. The MSMT report estimates that North Korea stole about $2.84 billion in crypto assets between January 2024 and September 2025.
V. What does this mean for the market?
● ETH selling pressure is concentrated in the early stage. The hackers' process of converting ETH into BTC involves real on-chain selling. The Bybit case took about 10 days and can serve as a reference.
● BTC selling pressure is small and dispersed. After conversion into BTC, cashing out mainly occurs through off-exchange mirror trades and may last for months or even years, mostly not passing through exchange order books, so the direct impact on price is very small.
● Hackers are not the main cause of major drops. On the day of the Bybit theft, ETH fell about 8%, and the subsequent major decline mainly came from macro factors such as tariffs and leverage liquidation.
What is different about this Binance incident? The bulk of the stolen assets were stablecoins, which have already been largely frozen; the directly unfreezable ETH amounts to about 195,000 coins, worth about $440 million, a smaller scale than the Bybit case. In addition, the hackers are using protocols such as Uniswap and Aave to convert stablecoins into ETH, so their final ETH holdings may increase.
What is worth watching next: traffic changes in cross-chain protocols such as THORChain and Chainflip, which are direct signals of the speed at which the hackers convert ETH into BTC.
This article is for educational purposes only and does not constitute investment advice. The Binance incident is still developing, and relevant data may be updated.