Odaily News The Bybit theft is generally considered to be the work of the North Korean hacker group Lazarus Group. Chainalysis has previously released a report on the "disposal" of the stolen money by the Lazarus Group. Generally, the Lazarus Group will take three steps to "dispose" of the stolen money: the first step is to convert all ERC20 (including liquidity derivative tokens such as stETH) into ETH; the second step is to convert ETH into BTC; the third step is to gradually convert BTC into legal currency through Asian exchanges. The whole process may last for many years.