Eight Months. Six Chains. 500 Wallets.
$0 Recovered.

On 21 February 2025, $1.46 billion left Bybit's cold wallet in a single transaction. Forty-seven seconds. The money was gone. What followed — the attempt by North Korea's Lazarus Group to convert $1.46 billion in instantly-recognisable stolen ETH into untraceable value — is the most meticulously documented large-scale crypto laundering operation ever attempted. It lasted eight months, crossed six blockchains, and used techniques that defeated every post-broadcast tracing tool deployed against it.

This is a reconstruction of what Lazarus did, how they did it, and why the forensic trail — however impressive — ended in the same place every on-chain investigation ends: a wall, a mixer, and $0 recovered.

The Problem Lazarus Had

Stealing $1.46 billion is one problem. Converting it to usable value is a harder one. The ETH in the 53 staging wallets that received the Bybit drain was not anonymous — it was among the most watched cryptocurrency in history within hours of the theft. Every major exchange had the staging wallet addresses on sanctions screening lists within 24 hours. Chainalysis, TRM Labs, ZachXBT, and dozens of independent researchers were tracking every transaction in real time. The ETH could not simply be deposited on an exchange. Lazarus needed to transform it — change its asset type, break the chain of custody, and convert it to value they could actually use.

Phase I — Rapid Dispersal (Days 1–3)

Within hours of the theft, the 53 initial staging wallets began disbursing to hundreds of secondary addresses. Lazarus used a fanning technique — each staging wallet sent to multiple sub-wallets, each sub-wallet to multiple further addresses — creating a tree structure that forensic tools can follow but that rapidly becomes computationally expensive to track comprehensively. The goal was not to make the trail invisible (it could not be — the chain is public) but to make it wide enough that tracking every branch simultaneously exceeded the available analytical resources.

By day three, the stolen ETH had touched over 400 wallet addresses. The blockchain showed all of it. The operational question for Lazarus was: where does this tree lead to where we can actually convert?

Phase II — The THORChain Bridge Strategy (Weeks 1–8)

THORChain is a decentralised cross-chain liquidity protocol that allows direct swaps between native assets on different blockchains — ETH to BTC, BTC to DOGE, RUNE to others — without wrapping or centralised intermediaries. It does not have AML controls. It does not maintain a sanctions screening list. It operates as designed: as a permissionless protocol that anyone can use.

Lazarus used THORChain to convert stolen ETH to native Bitcoin. This was the critical transformation: from Ethereum (where the theft occurred and where tracking is most sophisticated) to Bitcoin (where UTXO-based transaction structure provides different obfuscation opportunities). TRM Labs and Chainalysis tracked the THORChain conversions in near-real-time. The flows were clearly visible. THORChain's governance community debated whether to block Lazarus-attributed addresses; the protocol's validators ultimately did not implement blocking, citing technical and philosophical objections to censorship at the protocol level.

Over eight weeks, Lazarus converted approximately $480 million in ETH to native BTC through THORChain, averaging around $60 million per week in conversion volume.

Phase III — Fixed-Rate Exchanges and eXch (Months 2–5)

Fixed-rate cryptocurrency exchanges — services that offer guaranteed conversion rates without KYC requirements — became a significant part of Lazarus's laundering infrastructure during the middle phase. These services, legal in some jurisdictions, are specifically designed to allow users to convert assets without identity verification. They typically have small per-transaction limits, but Lazarus operated across hundreds of accounts and wallets simultaneously.

eXch, a fixed-rate exchange, became particularly prominent in post-theft tracing reports. Chainalysis and TRM Labs identified significant Lazarus-linked flows through eXch. The exchange's operators initially denied knowledge of Lazarus usage; later reporting suggested eXch processed hundreds of millions in Lazarus proceeds before eventually implementing some restrictions under regulatory pressure.

Phase IV — Bitcoin Mixing and OTC Desks (Months 5–8)

The final phase of the laundering operation involved Bitcoin mixing techniques — using coin-join transactions, peel chains, and OTC desk conversions to further obscure the BTC that had been converted from the original ETH. OTC (over-the-counter) cryptocurrency desks in jurisdictions with limited AML enforcement — historically, parts of Southeast Asia, Eastern Europe, and certain Gulf states — accepted the Bitcoin in exchange for fiat or alternative assets.

By month eight, Chainalysis estimated that approximately $1.2 billion of the $1.46 billion had been successfully laundered to a point where chain-of-custody tracing could not definitively connect the final assets to the Bybit theft. The remaining $260 million worth of ETH remained in tracked wallets — too "hot" to move without immediate identification.

Why Wallet Rotation Failed Against the Nullifier

One of Lazarus's core operational techniques is wallet rotation — using fresh, newly generated wallet addresses for each phase of an operation to prevent any single address from accumulating enough history to trigger automated alerts. The Bybit laundering operation used hundreds of fresh wallets across its 8-month duration. For conventional on-chain tracking tools, wallet rotation is a significant challenge: each new address has no history, no prior flags, and no direct link to the Lazarus operational cluster until a transaction from a known address establishes the connection.

The QCA biometric nullifier is designed specifically to defeat wallet rotation. The nullifier is a SHA3-256 hash derived from biometric data — not from the wallet address. Every wallet controlled by the same identity produces the same nullifier, regardless of how many new addresses are generated. When Lazarus creates wallet number 247 and attempts to broadcast a transaction through a QCA-gated node, the nullifier computed from the signing biometric matches the nullifier from wallets 1 through 246 — all of which are flagged. The new address provides no cover.