Bybit theft: FBI attributed February 2025 incident to North Korea
The advisory described approximately $1.5 billion stolen and subsequent movement across several blockchains.
- Cited claims
- 1
- Source records
- 1
- Edition revision
- 2
In this investigation
This is a theft-victim case
The FBI's February 2025 notice attributes the theft from Bybit to North Korea's TraderTraitor activity. Bybit is the affected exchange in this account, not a project found to be operating an investment scam. The notice supports the attribution stated by the FBI. It does not independently establish every proposed technical root cause, the present location of all proceeds or a current recovery percentage.
The official attribution
On 26 February 2025, the FBI issued an advisory attributing the theft of approximately $1.5 billion in virtual assets from Bybit to North Korea. It dated the theft to around 21 February and used the name TraderTraitor for the malicious activity. The exchange is the victim identified in this record; this is a theft report, not an allegation that Bybit ran a fraudulent investment programme.
What the notice reported
The FBI said some stolen assets had been converted into bitcoin and other virtual assets and dispersed across thousands of addresses on multiple blockchains. The advisory published Ethereum addresses associated with the stolen assets and encouraged relevant private-sector infrastructure and service providers to block transactions connected with the laundering activity.
What it did not establish
The notice did not provide a complete technical account of how the signing or custody system was compromised. It also did not establish the amount ultimately recovered. Those questions require separate sources. The address list should be understood in its dated investigative context rather than treated as an exhaustive or permanently current map of all affected funds.
Sources, dates and limits
The FBI advisory is dated 26 February 2025 and concerns the theft on or about 21 February. It is an attribution and funds-movement notice, not a technical root-cause report or a current measure of recoveries. Bybit is described as the victim exchange, not as the perpetrator of an investment scheme.
Evidence & sources
- Source reported
The FBI's February 26, 2025 advisory attributed the approximately $1.5 billion Bybit theft to North Korean TraderTraitor activity and described movement across multiple blockchains.
Supporting excerpt: North Korea Responsible for $1.5 Billion Bybit Hack
converted some of the stolen assets to Bitcoin and other virtual assets
North Korea Responsible for $1.5 Billion Bybit Hack ↗
