The Bybit Hack: How the Stolen Funds Were Laundered

In February 2025 North Korean hackers stole about $1.5 billion in crypto from the exchange Bybit, according to the FBI. The FBI says the thieves quickly swapped part of it into Bitcoin and other assets and spread it across thousands of addresses on several blockchains. Coins that pass through those addresses can reach ordinary users many hops later, and AML checkers mark them as stolen funds for that reason.

What the FBI said

On 26 February 2025 the FBI published public service announcement I-022625-PSA. It says North Korea was responsible for the theft of about $1.5 billion in virtual assets from Bybit on or about 21 February 2025.^[1]

The FBI calls this North Korean activity "TraderTraitor".^[1] The name is not new. A 2022 joint advisory by the FBI, CISA and the U.S. Treasury used it for a North Korean state-sponsored group that targets crypto exchanges, DeFi protocols and trading firms. The advisory says industry tracks the same actors as Lazarus Group, APT38 and BlueNoroff, and that they often lure staff with fake job offers and trojanised trading apps.^[2]

How the funds moved

The FBI described the laundering in broad terms:^[1]

• The actors moved fast. They converted some of the stolen assets to Bitcoin and other virtual assets.
• The funds were dispersed across thousands of addresses on multiple blockchains.
• The FBI expected the assets to be laundered further and eventually converted to fiat currency.

The PSA lists 51 Ethereum addresses that hold or have held assets from the theft and are linked to TraderTraitor. It asks RPC node operators, exchanges, bridges, blockchain analytics firms, DeFi services and other virtual asset service providers to block transactions with, or derived from, those addresses.^[1]

That list of service types matters. The FBI is not only asking exchanges to watch for these coins. It names the infrastructure that lets funds change chain or change asset.

Why cross-chain swaps break simple checks

A theft on Ethereum does not stay on Ethereum. Cross-chain protocols let anyone swap one native coin for another. THORChain, for example, describes itself as a decentralised cross-chain liquidity protocol that does not peg or wrap assets. Its documentation names BTC and ETH among the layer-1 assets it supports.^[3]

In practice this means ETH can go in on one side and native BTC can come out on the other. The Bitcoin address that receives it has no Ethereum history of its own. A checker that only looks at one chain will miss the link. Good AML tools follow such swaps across chains, so a Bitcoin address can carry a "stolen funds" label that started with an Ethereum theft. See our page on THORChain and AML checks for how services handle this.

The FBI PSA does not say which swap services or bridges the actors used. We do not name them here either.

The sanctions angle

Stolen funds and sanctioned funds are different risk categories. With North Korea, they overlap.

In 2019 the U.S. Treasury sanctioned Lazarus Group, Bluenoroff and Andariel as North Korean state-controlled cyber groups. Treasury said Lazarus is controlled by North Korea's main intelligence bureau, the Reconnaissance General Bureau. U.S. persons are generally barred from dealing in their blocked property.^[4]

OFAC has also acted against the people who launder for them. Its virtual currency guidance cites a March 2020 case: two Chinese nationals were sanctioned for laundering about $100 million in crypto stolen from two exchanges in a North Korean scheme.^[5]

The same guidance says sanctions obligations apply equally to crypto and fiat, and that companies must not deal in prohibited transactions "directly or indirectly". OFAC can impose civil penalties on a strict liability basis, so a firm can be liable even without knowing it broke the rules.^[5] Blocked virtual currency must be reported to OFAC within 10 business days.^[5]

This is why exchanges react strongly to Bybit-linked coins. For them it is not only a theft question. It can be a sanctions question too. Our sanctions risk page explains how checkers score that exposure.

What this means if you receive coins downstream

Most people who touch these funds are not launderers. They are the next buyer on a P2P desk, the merchant paid in BTC, or the trader who sold to an OTC broker.

An AML checker scores where the coins came from. If an address received funds that trace back to the theft, the report can show "stolen funds", "sanctions" or both, often with a share of the balance. Read more on the stolen funds risk category.

What happens next is the receiving platform's decision, not the checker's. An exchange may hold the deposit, ask for an explanation, or block it. A clean score from one tool does not bind the exchange, and the exchange may use a different provider.

This is not legal advice. If you hold a large amount with a direct link to these addresses, talk to a lawyer.

What to do

1. Check before you accept. Run the sending address through an AML checker before a P2P or OTC deal, not after.
2. Look at all chains. If you receive BTC, choose a checker that follows cross-chain swaps. A one-chain view can miss an Ethereum origin.
3. Read the category, not just the score. "Stolen funds" and "sanctions" next to North Korea are high-risk labels, even at a small share.
4. Do not send flagged coins to an exchange to "test" them. The deposit can be frozen and you will have to explain it.
5. Keep records. Save chats, receipts and transaction IDs. They help if a platform asks where the coins came from.
6. Report what you know. The FBI asks for reports through a local field office or ic3.gov.^[1]

If an exchange has already held your deposit, start with our guide on what to do when an exchange freezes funds. To compare tools that trace across chains, see the service comparison.

We track this and other major incidents, with flagged addresses, in our hacks and freezes tracker.