Bybit has won a significant legal victory in its effort to recover assets from a $1.5 billion cryptocurrency theft, securing U.S. court support to compel information from American platforms that may have handled the stolen funds. However, the exchange faces a daunting reality: approximately 90% of the stolen cryptocurrency has already become untraceable after being moved through thousands of blockchain addresses and multiple networks.

What Happened in the Bybit Hack, and Who Was Behind It?

In February 2025, Bybit suffered one of the largest cryptocurrency thefts on record when attackers compromised a single Ethereum cold wallet during what should have been a routine transfer. A cold wallet is a cryptocurrency storage system kept offline, designed to be more secure than internet-connected alternatives. The attackers made off with approximately $1.46 billion in assets, including Ethereum (ETH) and several Ethereum-based liquid staking tokens, which are digital assets that represent locked cryptocurrency earning rewards.

The U.S. Federal Bureau of Investigation (FBI) formally attributed the theft to North Korean actors, identifying the activity as part of what it calls the "TraderTraitor" campaign. Security researchers have linked the attack to the Lazarus Group, a hacking operation widely associated with North Korea that has targeted cryptocurrency exchanges and financial platforms for years.

Why Is Tracing Stolen Crypto So Difficult, Even on a Public Blockchain?

Cryptocurrency is often described as transparent because all transactions are permanently recorded on public ledgers. However, that transparency has a critical limitation: while investigators can see transactions between addresses, determining who actually controls those addresses is an entirely different challenge. The Bybit case illustrates this gap perfectly.

The attackers did not simply leave the stolen assets in one place. According to the FBI, the stolen funds were rapidly converted into Bitcoin and other virtual assets and dispersed across multiple blockchains. This speed became one of the defining characteristics of the incident. Once cryptocurrency is divided across hundreds or thousands of addresses, recovery becomes exponentially more complicated. The complexity increases further when assets move between different blockchain networks, each with its own transaction structure and record-keeping system.

Investigators must then reconstruct multiple transaction histories and determine whether seemingly unrelated addresses are actually connected to the original theft. Cryptocurrency mixers and other privacy-enhancing services can also make investigations more challenging by breaking obvious links between deposits and withdrawals. The result is a sprawling trail that becomes harder to follow with each additional layer of movement.

How the Court Order Could Help Investigators

The latest court development is important because blockchain analysis alone cannot always provide enough information to identify the people behind a wallet. A court-backed legal process can potentially give Bybit access to information held by companies operating within the United States. That information could include account records, transaction histories, or other data that may help investigators connect blockchain addresses with specific services or entities.

The goal is not necessarily to recover the entire $1.5 billion. Instead, investigators are trying to identify whatever portion of the stolen funds may still be accessible. Even a relatively small recovery could provide valuable evidence about the laundering network and the entities that interacted with the stolen assets. The court order essentially opens a new investigative avenue by allowing Bybit to compel U.S.-based platforms to disclose information about transactions connected to the theft.

Steps Investigators Use to Track Stolen Cryptocurrency

• Blockchain Analysis: Investigators use specialized software to trace transactions across public ledgers, mapping the movement of stolen assets from their original addresses to subsequent wallets and exchanges.
• Cross-Chain Tracking: When assets move between different blockchain networks, investigators must follow transaction histories across multiple systems with different technical structures and record formats.
• Legal Subpoenas: Court-backed orders compel U.S.-based cryptocurrency platforms and financial services to disclose account information, transaction records, and user data connected to suspicious addresses.
• Pattern Recognition: Analysts look for behavioral patterns in how addresses interact, such as timing of transactions, amounts moved, and connections to known services, to identify potential laundering networks.
• International Coordination: Law enforcement agencies work with foreign counterparts to track assets that move through exchanges and services in other jurisdictions.

The Speed Problem: Why 90% of Funds Have Gone Dark

The biggest obstacle facing Bybit is the speed at which the stolen assets were moved. Recent reports indicate that roughly 90% of the stolen cryptocurrency has become untraceable. That does not necessarily mean the assets have disappeared from the blockchain. In many cases, "untraceable" means investigators can no longer reliably determine where the funds are being controlled or how they are connected to the original theft.

When a major exchange is hacked, investigators immediately begin identifying the attacker's addresses. Exchanges and blockchain infrastructure companies can then attempt to flag or freeze transactions connected to those addresses. However, the window for action is extremely narrow. The Bybit attackers moved assets so quickly that most of the stolen cryptocurrency passed through the system before protective measures could be implemented. This demonstrates one of the most important lessons from the incident: in cryptocurrency theft, speed is everything.

The assets may have passed through numerous wallets, decentralized services, cross-chain bridges, and other mechanisms designed to make transaction histories harder to follow. This creates a significant difference between seeing a transaction and understanding it. A transaction on a blockchain does not automatically reveal who controls every address involved or where the funds are ultimately headed.

What This Case Reveals About Cryptocurrency Security

The Bybit incident demonstrates how quickly stolen assets can be moved through the global crypto ecosystem. A theft worth more than $1 billion is not simply a cryptocurrency security incident. It has implications for international sanctions, cybercrime investigations, and national security. The case also highlights both the transparency and the limitations of blockchain technology. While cryptocurrency transactions are permanently recorded on public ledgers, sophisticated laundering strategies can make it extremely difficult to connect blockchain addresses to real-world individuals or organizations.

The FBI's warning that the attackers were expected to continue laundering the assets and eventually convert some of them into fiat currency demonstrates how quickly the situation could evolve. Once stolen cryptocurrency is divided across thousands of addresses, recovery becomes increasingly complicated. Security researchers and blockchain investigators continue to develop methods for tracking illicit cryptocurrency flows, but sophisticated actors continue to adapt their techniques to stay ahead of law enforcement.

Bybit's pursuit of the court order represents a recognition that blockchain analysis alone may not be sufficient to recover the stolen funds. By combining on-chain investigation with traditional legal tools, the exchange is attempting to identify any remaining portion of the assets that might still be frozen or recovered. Whether this effort will yield significant results remains uncertain, but it underscores the ongoing challenge that cryptocurrency theft poses to both exchanges and law enforcement agencies worldwide.