Bybit Hacker Moves Stolen Funds via Thorchain & OKX DEX
The Bybit hacker is using Thorchain and OKX DEX to transfer stolen funds, converting assets into DAI before moving them to eXch.

- BeosinTrace tracked the Bybit hacker’s latest transaction at 08:58:23 UTC+8.
- The hacker is using Thorchain to transfer assets to the BTC chain.
- OKX DEX is being used to convert funds into DAI before moving them to eXch.
Bybit Hacker Continues Fund Movements via Thorchain & OKX DEX
Blockchain security firm BeosinTrace has reported another fund transfer by the Bybit hacker today at 08:58:23 UTC+8. The hacker appears to have established a consistent method for laundering the stolen assets, primarily leveraging decentralized exchanges and cross-chain protocols.
How Is the Hacker Moving Funds?
The hacker’s current method involves:
- Thorchain for Cross-Chain Transfers – The stolen assets are first moved to the BTC chain using Thorchain, a decentralized cross-chain liquidity protocol.
- OKX DEX for Asset Conversion – The hacker then swaps the transferred assets into DAI on the OKX decentralized exchange.
- Final Destination: eXch – The converted DAI is eventually sent to eXch, though its purpose remains unclear.
What Does This Mean for Crypto Security?
This case highlights the increasing use of decentralized platforms for illicit fund transfers. Unlike centralized exchanges, which require KYC verification and can freeze suspicious transactions, decentralized protocols offer anonymity and are harder to track.
Authorities and blockchain security firms continue to monitor these movements, but the hacker’s tactics show how difficult it is to trace stolen funds once they are mixed across multiple chains.