The evidence
On February 26, 2025, the FBI attributed the theft of approximately $1.5 billion in virtual assets from Bybit to North Korea. Its statement placed the theft on or about February 21 and described subsequent conversion and dispersal activity.
This is a dated official attribution concerning a specific incident. It is not evidence that every later transfer involving the same assets or services was controlled by the original attackers.
Source: FBI public service announcement, February 26, 2025.
FOLITIC analysis
Wallet investigations depend on the quality of the link between records. A direct transaction is observable. Common control, intent and knowledge generally require additional evidence. Treating all connected addresses as one actor can turn a legitimate tracing exercise into an unsupported accusation.
Market impact also has several stages. The initial theft affects the victim’s balance sheet and operations. Later asset conversions can affect liquidity at the venues used. Recovery, replacement purchases and service restrictions may produce additional effects in the opposite direction.
These stages should not be combined into a simple claim that the full stolen amount was sold immediately. Transaction evidence and venue records are needed to establish what was exchanged, when and at what scale.
What to watch
Use official incident statements and dated tracing updates as the starting point. Distinguish stolen value from trading volume, and clearly identify whether a wallet label comes from authorities, an analytics firm or an unverified public claim.
Image: File photograph of a Trezor Model T, illustrating custody controls rather than equipment involved in the incident. Credit: FlippyFlink via Wikimedia Commons. Image license: CC0. Displayed with a responsive crop. This illustrative image does not depict the reported transaction.
