Bybit Theft Shows Crypto Moves Faster Than It Converts to Fiat

The theft of about $1.5 billion from Bybit shows how quickly stolen crypto can spread across blockchains while conversion into fiat currency creates more points where assets may be identified or restrained.

The FBI attributed the theft, which occurred on or about Feb. 21, 2025, to North Korean actors tracked as TraderTraitor. Some of the assets were quickly converted into Bitcoin (BTC) and other virtual assets before being distributed across thousands of addresses on multiple blockchains.

That process turned the incident into more than a single transfer. The funds had to be divided, converted and moved through different blockchain environments as they approached eventual conversion into fiat currency. The FBI expected further laundering before that stage.

Where Intervention Can Occur

Blockchain transactions remain visible, but an address does not automatically identify the person controlling it. Following the movement of funds also does not guarantee that a transaction can be stopped.

Centralized issuers and intermediaries can sometimes intervene. Tether CEO Paolo Ardoino announced a freeze of $181,000 in Tether USDt (USDT) linked to the hack at 8:15 a.m. ET (13:15 UTC) on Feb. 22, 2025.

By 10:41 a.m. ET (15:41 UTC) on Feb. 23, $42.89 million in exploited funds had been frozen. Bybit credited assistance from Tether, THORChain, ChangeNOW, FixedFloat, Avalanche, CoinEx, Bitget and Circle.

Decentralized systems and self-custodied assets can be harder to restrain. Spreading assets across multiple chains and addresses also increases the number of transactions and entities investigators must follow.

The broader laundering infrastructure identified by U.S. authorities includes payment-services institutions, virtual-asset service providers, online marketplaces and other intermediaries. Such networks can provide services used to move illicit funds, but the available record does not establish that any one network processed the entire Bybit theft.

Recovery and Laundering Networks

Bybit valued the compromised Ether (ETH) at more than $1.4 billion when the incident occurred. The exchange offered a recovery bounty equal to 10% of recovered funds, potentially reaching $140 million if the entire amount were recovered.

At 9:35 p.m. ET on Feb. 23 (02:35 UTC on Feb. 24), Bybit had received $1.23 billion in Ether through bridge loans, whale deposits and over-the-counter purchases. The funds covered the Ether deficit created by the exploit.

Bybit co-founder and CEO Ben Zhou said, “Within 24 hours of the event, we were overwhelmed with support from some of the best people and organizations in the industry, and we do not take it for granted.”

The Financial Crimes Enforcement Network (FinCEN) identified Cambodia-based Huione Group as a network that laundered at least $4 billion in illicit proceeds between August 2021 and January 2025. FinCEN also identified at least $37 million in convertible virtual currency connected to North Korean cyber heists, without tying that amount specifically to the Bybit theft.

Huione Group's network included a payment-services institution, a virtual-asset service provider and an online marketplace. The businesses lacked published anti-money-laundering and know-your-customer policies, according to the agency's findings.

The U.S. Treasury Department said Xinbi Guarantee processed the equivalent of more than $24 billion in digital assets and fiat currency since around 2022. Treasury said North Korean hackers had reportedly used the platform, but did not assign any specific amount of Bybit proceeds to Xinbi.

U.S. Treasury Secretary Scott Bessent described Huione Group as a marketplace used by malicious cyber actors and criminal syndicates that have stolen billions of dollars from Americans.

The Bybit case illustrates the operational gap between moving stolen crypto and converting it into fiat. Assets can cross chains and addresses quickly, but cashing out may require services, issuers or intermediaries where funds can be frozen or transaction trails examined.