Mantle's liquid restaking protocol, mETH Protocol, announced on Saturday the recovery of 15,000 cmETH tokens, worth about $43 million at current prices, from the Lazarus Group attackers responsible for the $1.4 billion hack of centralized exchange Bybit on Friday.
"The 8-hour withdrawal delay built into the protocol provided the team with critical response time to temporarily pause the contract, effectively stopping unauthorized withdrawals," the protocol said on X. "15,000 cmETH were recovered from the exploiter's address to a recovery address." Early reports mistakenly suggested that the 15,000 tokens were burned.
The recovery was initiated by Mudit Gupta, chief information security officer at Polygon, and assisted by rapid-response security team SEAL, according to Gupta's post on X. "I saw the recovery possibility soon after the hack and SEAL connected me with Mantle/mETH team who made it happen," Gupta said.
The recovery could be subject to a $4.3 million recovery bounty under the terms of Bybit's recently-announced program. Bybit was unable to be immediately reached for comment regarding the recovery.
The $43 million recovery already surpasses the $30 million salvaged from the North Korean state-sponsored Lazarus Group's attack on the Ronin Bridge associated with crypto project Axie Infinity. That recovery, spearheaded by blockchain security firm Chainalysis and assisted by U.S. law enforcement, took nearly six months.
Tether freezes $181,000
Tether CEO Paolo Ardoino likewise announced Saturday that 181,000 USDT tokens connected to the hack were frozen in another early recovery.
"Might not be much but it's honest work," Ardoino said on X. "We keep monitoring."
Tether was one of four stablecoin issuers to freeze $5 million worth of tokens in September 2024 from wallets linked to the Lazarus Group by pseudonymous security researcher ZachXBT, alongside Paxos, Techteryx, and Circle. The funds were stolen in 25 separate exploits on numerous different blockchains, and cashed out using peer-to-peer exchanges.
Disclaimer: The Block is an independent media outlet that delivers news, research, and data. As of November 2023, Foresight Ventures is a majority investor of The Block. Foresight Ventures invests in other companies in the crypto space. Crypto exchange Bitget is an anchor LP for Foresight Ventures. The Block continues to operate independently to deliver objective, impactful, and timely information about the crypto industry. Here are our current financial disclosures.
© 2025 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
