Bybit hack raises fear of criminal prosecution for negligent crypto leaders

In the aftermath of Bybit’s $1.4 billion loss — the world’s largest crypto exchange hack — many once-celebrated services are struggling to control the laundering of criminal proceeds.

Memecoin generator Pump.fun, permissionless token exchange ThorChain, and many others are trying to comply with Countering the Financing of Terrorism (CFT) and Anti-Money Laundering (AML) rules.

Bybit, which once claimed to be the world’s second most popular crypto exchange by trading volume, suffered a $1.4 billion hack on February 21. Its executives signed a malicious transaction that allowed hackers to sweep ether (ETH) from its multi-signature wallets.

As panic set in, customers rushed to withdraw over $4 billion in deposits. Nevertheless, Bybit was able to secure some loans, and as of approximately 12 hours ago, claimed to have replenished liquidity to back customer deposits on a 1:1 basis.

Over the past three days, hackers have swapped and liquidated some of the proceeds of their crime. In a game of whack-a-mole, leaders of supposedly decentralized or permissionless protocols rushed to manually intervene.

Leadership to the rescue of decentralized crypto

Because many researchers have made credible allegations that the hackers have North Korean support, international sanctions might apply to those stolen funds.

Not only is preventing their money-laundering activities probably a moral thing to do, but failing to CFT/AML also implicates possible criminal prosecution.

Already, forensic researcher ZachXBT has claimed that hackers swapped over 37,000 stolen ETH for bitcoin and altcoins using exchanges with lax controls like ChainFlip, ThorChain, LiFi, DLN, and eXch. (Disagreeing with ZachXBT, eXch claims that it is “not laundering money for Lazarus/DPRK.”)