mETH Protocol announces $43 million recovery from Bybit hack, while Tether freezes $181,000

Mantle's liquid restaking protocol, mETH Protocol, announced on Saturday the recovery of 15,000 cmETH tokens, worth about $43 million at current prices, from the Lazarus Group attackers responsible for the $1.4 billion hack of centralized exchange Bybit on Friday. 

"The 8-hour withdrawal delay built into the protocol provided the team with critical response time to temporarily pause the contract, effectively stopping unauthorized withdrawals," the protocol said on X. "15,000 cmETH were recovered from the exploiter's address to a recovery address." Early reports mistakenly suggested that the 15,000 tokens were burned. 

The recovery was initiated by Mudit Gupta, chief information security officer at Polygon, and assisted by rapid-response security team SEAL, according to Gupta's post on X. "I saw the recovery possibility soon after the hack and SEAL connected me with Mantle/mETH team who made it happen," Gupta said.

A Bybit representative confirmed that the recoveries are eligible for a recovery bounty under the terms of Bybit's recently-announced program. The bounties would likely total $4.3 million for Gupta and relevant members of SEAL and mETH Protocol and $18,100 for Ardoino and Tether. 

Bybit's X account on Sunday published a post praising multiple exchanges and blockchain networks for helping to freeze $42.89 million in one day. Several exchanges helped to block wallet addresses on a blacklist released by the exchange of wallets involved in laundering the hack's proceeds. 

The $43 million recovery already surpasses the $30 million salvaged from the North Korean state-sponsored Lazarus Group's attack on the Ronin Bridge associated with crypto project Axie Infinity. That recovery, spearheaded by blockchain security firm Chainalysis and assisted by U.S. law enforcement, took nearly six months. 

Tether freezes $181,000

Tether CEO Paolo Ardoino likewise announced Saturday that 181,000 USDT tokens connected to the hack were frozen in another early recovery. 

"Might not be much but it's honest work," Ardoino said on X. "We keep monitoring."

Tether was one of four stablecoin issuers to freeze $5 million worth of tokens in September 2024 from wallets linked to the Lazarus Group by pseudonymous security researcher ZachXBT, alongside Paxos, Techteryx, and Circle. The funds were stolen in 25 separate exploits on numerous different blockchains, and cashed out using peer-to-peer exchanges. 

Updated 2/23 at 11:00 am EST with additional details from Bybit's recovery efforts.