The hacker Lazarus behind the Bybit theft processed the stolen funds through ETH-BTC-fiat currency, and the process of selling the stolen funds may last for many years

Odaily News The Bybit theft is generally considered to be the work of the North Korean hacker group Lazarus Group. Chainalysis has previously released a report on the "disposal" of the stolen money by the Lazarus Group. Generally, the Lazarus Group will take three steps to "dispose" of the stolen money: the first step is to convert all ERC20 (including liquidity derivative tokens such as stETH) into ETH; the second step is to convert ETH into BTC; the third step is to gradually convert BTC into legal currency through Asian exchanges. The whole process may last for many years.