Blockchain investigator ZachXBT says he has traced more than $12 million in funds linked to the 2025 Bybit theft, adding a specific dollar figure to the growing picture of where stolen cryptocurrency travels after a major exchange hack.

What the investigator says he traced

ZachXBT, an independent on-chain investigator known for following stolen cryptocurrency across blockchains, reported tracing over $12 million connected to the Bybit theft. The claim attaches a concrete amount to funds that had previously moved without a public paper trail.

The report remains a claim rather than a confirmed legal finding. As of this writing, it has not been independently confirmed by Bybit or law enforcement. Tracing funds on a blockchain means identifying the wallet addresses that received or moved specific tokens. It does not automatically mean those funds have been frozen, recovered, or tied to a named individual.

A track record of on-chain forensics

ZachXBT has built a reputation for identifying fund flows that law enforcement and exchanges miss. Because he operates independently of any exchange or agency, his conclusions rest on publicly visible transaction data alone In a separate case, he traced $120.2 million in USDT flows that eventually led to a Tether freeze, demonstrating how on-chain tracing can produce real-world consequences. He has also identified a $3.8 million exploit on the NEAR Intents protocol, an example of how investigators follow funds across different blockchain networks. Those cases highlight how publicly visible transaction histories allow independent researchers to map the movement of stolen assets even when official channels have not yet acted.

How the claim connects to the Bybit theft

The Bybit theft occurred in 2025 and ranked among the larger exchange security incidents of that year. Exchange hacks typically involve attackers gaining access to hot wallets — online storage connected to the internet — or exploiting vulnerabilities in withdrawal systems to move customer funds out without authorization.

Once stolen funds leave an exchange, attackers usually attempt to obscure the trail by moving the crypto through multiple wallets, converting between tokens, or using privacy-focused tools. Investigators like ZachXBT work backward through those transactions to reconstruct where the money went. Comparable forensic work has helped the FBI trace Bitcoin payments in criminal cases, illustrating how blockchain's public ledger can work against those attempting to conceal illicit funds.

The $12 million figure ZachXBT reported represents a portion of the total funds taken in the Bybit incident. Whether additional amounts remain untraced, or whether the full stolen sum has been partially identified through separate investigations, has not been confirmed in the available reporting.

Why the tracing claim matters for crypto holders

For anyone who holds cryptocurrency on an exchange, a public tracing report like this one carries a practical message: stolen funds are not always gone forever. When a skilled investigator can follow more than $12 million across the blockchain, it demonstrates that the transparency of public ledgers cuts both ways. Attackers who steal from exchanges leave a permanent record of every transaction they make, one that can be re-examined at any time.

Tracing, however, is not the same as recovering. Until an exchange, regulator, or law enforcement agency confirms that traced funds have been frozen or returned, the report should be treated as one step in a longer process. The earlier Tether case shows one form that next step can take: confirmed freezes following a published trace. Follow-up statements from Bybit or the relevant authorities remain the clearest signal of whether the situation moves toward resolution.

The case is also a reminder for users of centralized exchanges to understand how a platform handles security incidents — from how it stores customer assets to whether it carries insurance or maintains a recovery fund for users affected by theft.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.