Read a blockchain theft advisory without overclaiming what it proves

Identify the document's scope

Practical checklist · not an audit of another provider

Record who issued the advisory, when the incident occurred and when the document was published. Check whether it reports an attribution, technical root cause, sanctions action or recovery. These are different purposes. The Bybit FBI notice is a useful example of a document that identifies actors and fund movements without providing a complete technical postmortem.

Preserve address context

Practical checklist · not an audit of another provider

Copy network and address identifiers exactly from the official source if they are relevant to a report. Do not assume a list is exhaustive or current forever. An address connection also needs interpretation; it is not permission to identify an unrelated person as a criminal. Do not send a test payment or interact with a suspicious contract to investigate a notice.

Verify subsequent claims separately

Practical checklist · not an audit of another provider

A later recovery claim should identify what was recovered, by whom and on what date. A transfer visible on a chain is not automatically a recovery. If you personally lost funds, preserve your transaction history and use verified reporting channels. The FBI's victim guidance warns against paying people who promise recovery after an incident.

Read an incident notice with a scope checklist

Practical checklist · not an audit of another provider

Record incident date, affected organisation, agency attribution, network identifiers and the notice's publication date. In separate fields, note whether the source actually explains the exploit and whether it provides a dated recovery figure. Leave those fields unknown when absent. Copy addresses only from the official notice and preserve their network context. Never send funds, connect a wallet or install a purported investigation tool to validate an address. A report can be useful while leaving important technical questions unanswered.

Sources, dates and limits

The FBI advisory is dated 26 February 2025 and concerns the theft on or about 21 February. It is an attribution and funds-movement notice, not a technical root-cause report or a current measure of recoveries. Bybit is described as the victim exchange, not as the perpetrator of an investment scheme.