Arkham reports that Lazarus laundered the Bybit ETH cold-wallet proceeds by bridging 500,000 ETH, worth about $1.3 billion, from Ethereum into native Bitcoin. About 72% moved through THORChain, with other flows using THORChain frontends, AsgarDEX, and eXch, a chain-hopping pattern intended to slow cross-chain tracing. THORChain processed more than $5.5 billion in volume after the hack and earned roughly $5.5 million in fees, creating a recovery dispute because decentralized protocol fees are distributed by code rather than controlled by a single operator.