ZachXBT Traces $12M Linked to 2025 Bybit Theft

Blockchain investigator ZachXBT says he traced more than $12 million in funds linked to the 2025 Bybit theft, adding to a growing picture of where stolen crypto goes after a major exchange hack.

What ZachXBT says he traced

ZachXBT, an independent on-chain investigator known for following stolen cryptocurrency across blockchains, reported tracing over $12 million connected to the Bybit theft. The claim places a specific dollar figure on funds that had previously moved without a public paper trail. For related coverage, see JPMorgan: Crypto Inflows Hit $50B in 2026.

ZachXBT has a track record of identifying fund flows that law enforcement and exchanges miss. In a separate case, he traced $120.2 million in USDT flows that eventually led to a Tether freeze, demonstrating how on-chain tracing can produce real-world consequences. He has also identified a $3.8 million exploit on the NEAR Intents protocol, showing how investigators track funds across different blockchain networks.

It is important to note that ZachXBT’s report is a claim, not a confirmed legal finding. Tracing funds on a blockchain means identifying wallet addresses that received or moved specific tokens. It does not automatically mean those funds have been frozen, recovered, or tied to a named individual. For related coverage, see Binance News Today: DOJ Reviews 2023 Settlement.

How the claim connects to the 2025 Bybit theft

The Bybit theft occurred in 2025 and represented one of the larger exchange security incidents of that year. Exchange hacks involve attackers gaining access to hot wallets (online storage connected to the internet) or exploiting vulnerabilities in withdrawal systems to move customer funds out without authorization.

Once funds leave an exchange in a theft, attackers typically try to obscure the trail by moving crypto through multiple wallets, converting between tokens, or using privacy-focused tools. Investigators like ZachXBT work backward through those transactions to reconstruct where the money went. Similar forensic work has helped the FBI trace Bitcoin payments in criminal cases, illustrating that blockchain’s public ledger can work against those trying to hide illicit funds.

The $12 million figure ZachXBT reported represents a portion of the total funds taken in the Bybit incident. Whether additional amounts remain untraced, or whether the full stolen sum has been partially identified through separate investigations, has not been confirmed in the available reporting.

Why this tracing claim matters for crypto holders

For anyone who holds cryptocurrency on an exchange, a public tracing report like this one carries a practical message: stolen funds are not always gone forever. When a skilled investigator can follow more than $12 million across the blockchain, it demonstrates that the transparency of public ledgers cuts both ways. Attackers who steal from exchanges leave a permanent record of every transaction they make.

That said, tracing is not the same as recovering. Until an exchange, regulator, or law enforcement agency confirms that traced funds have been frozen or returned, users should treat the report as one step in a longer process. Watch for follow-up statements from Bybit or relevant authorities before assuming the situation is resolved.

If you hold funds on any centralized exchange, this case is a reminder to understand how the platform handles security incidents and whether it carries insurance or a recovery fund for users affected by theft.

Additional source references: source document 1, source document 2.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.