U.S. Court Freezes Bybit's Stolen Related Assets
A federal court in Washington, D.C. has issued a preliminary injunction against Bybit, freezing identified digital assets related to the $1.5 billion theft case in 2025, prohibiting relevant holders from transferring or disposing of the funds.
Bybit has sued North Korea, the North Korean Reconnaissance General Bureau, the Lazarus Group, and anonymous defendants referred to as "John Doe" who hold or transfer the funds. The court found that Bybit "has demonstrated a likelihood of success on the merits of its claims"; this ruling is a temporary remedy to preserve assets and is not a final judgment on liability or ownership of the assets.
The on-chain assets that can be frozen and the addresses involved will become major compliance risk points for exchanges, custodians, and market-making platforms; Bybit has recovered approximately $48.4 million and has frozen about $30.5 million across more than 28 exchanges and custodial institutions. Centralized platforms will continue to bear the costs of law enforcement collaboration and address interception, while on-chain tracking, sanctions screening, and asset recovery service providers will benefit from the demand for cross-platform freezes.
Source: Public Information
ABAB AI Insight
The Bybit case continues the existing pattern of the Lazarus Group using cross-chain exchanges, mixing services, and over-the-counter withdrawals to dilute tracking clues. After the Ronin Network was hacked for about $625 million in 2022, the U.S. Treasury sanctioned Ethereum addresses related to that case; the 2025 Bybit attack involved 401,347 ETH, 90,375 stETH, and various liquid staking assets, significantly escalating the scale of the attack.
After the incident, Bybit did not rely solely on on-chain tracking but established a 10% bounty mechanism to encourage trackers to submit the flow of funds to exchanges and law enforcement agencies. Its capital path is to transform "on-chain identifiability" into "platform executability": address labeling alone cannot prevent transfers; only when exchanges, stablecoin issuers, bridging protocols, and judicial injunctions intervene simultaneously can tracking results potentially become freezeable assets.
A historical analogy is the Mareva injunction or asset preservation order in traditional finance: if the plaintiff can prove that funds may be transferred before a final judgment, they can request the court to freeze the assets in advance. The difference is that control over crypto assets does not depend on a single bank account; the court can restrain holders and service providers within U.S. jurisdiction but cannot directly control private keys or on-chain protocols, so the success rate of recovery depends on whether the funds re-enter regulated liquidity nodes.
This represents a regulatory change. In the past, exchanges' security responsibilities primarily stopped at theft prevention and compensation; they are now expanding to post-incident asset identification, cross-platform collaboration, civil recovery, and sanctions enforcement. On-chain finance has not eliminated judicial authority but has shifted the key nodes of judicial enforcement from bank accounts to exchange accounts, custodial addresses, stablecoin contracts, and fiat entry and exit points.
ABAB News · Cognitive Laws
On-chain traceability does not equal asset recoverability
Private keys determine control, entry points determine execution rights
The endpoint of stolen coins is not on-chain, but at liquidity exits