The Bybit case continues the existing pattern of the Lazarus Group using cross-chain exchanges, mixing services, and over-the-counter withdrawals to dilute tracking clues. After the Ronin Network was hacked for about $625 million in 2022, the U.S. Treasury sanctioned Ethereum addresses related to that case; the 2025 Bybit attack involved 401,347 ETH, 90,375 stETH, and various liquid staking assets, significantly escalating the scale of the attack.

After the incident, Bybit did not rely solely on on-chain tracking but established a 10% bounty mechanism to encourage trackers to submit the flow of funds to exchanges and law enforcement agencies. Its capital path is to transform "on-chain identifiability" into "platform executability": address labeling alone cannot prevent transfers; only when exchanges, stablecoin issuers, bridging protocols, and judicial injunctions intervene simultaneously can tracking results potentially become freezeable assets.

A historical analogy is the Mareva injunction or asset preservation order in traditional finance: if the plaintiff can prove that funds may be transferred before a final judgment, they can request the court to freeze the assets in advance. The difference is that control over crypto assets does not depend on a single bank account; the court can restrain holders and service providers within U.S. jurisdiction but cannot directly control private keys or on-chain protocols, so the success rate of recovery depends on whether the funds re-enter regulated liquidity nodes.

This represents a regulatory change. In the past, exchanges' security responsibilities primarily stopped at theft prevention and compensation; they are now expanding to post-incident asset identification, cross-platform collaboration, civil recovery, and sanctions enforcement. On-chain finance has not eliminated judicial authority but has shifted the key nodes of judicial enforcement from bank accounts to exchange accounts, custodial addresses, stablecoin contracts, and fiat entry and exit points.

ABAB News · Cognitive Laws

On-chain traceability does not equal asset recoverability
Private keys determine control, entry points determine execution rights
The endpoint of stolen coins is not on-chain, but at liquidity exits