The theft of roughly $1.5 billion in cryptocurrency from Bybit in February 2025 attracted attention for the scale of the hack. The harder question came afterward: how could the attackers turn digital assets they controlled into money that could actually be used?
According to CryptoSlate, blockchain investigator ZachXBT attempted to answer that question by posing as a customer of a Chinese crypto-laundering network. His work illustrates why stealing cryptocurrency and converting it into spendable value are separate challenges, and why the intermediaries that support illicit transactions can become targets for investigators and regulators.
A costly route into the laundering network
The FBI attributed the Bybit theft to North Korean hackers on Feb. 26, 2025, identifying the activity as TraderTraitor. It said the stolen assets were being converted into Bitcoin and other cryptocurrencies and distributed across thousands of blockchain addresses.
The hackers could move funds on public blockchains, but blockchain records alone do not necessarily reveal who controls an address or why a transaction took place. That made the intermediaries handling exchanges, transfers and settlement central to the investigation.
ZachXBT said he noticed more than 15 accounts in public Telegram and Discord groups seeking assistance with transactions connected to the stolen Bybit assets. He eventually established contact with a person using the Telegram alias Jimmy Green, who appeared to offer help moving cryptocurrency between networks.
On March 6, 2025, ZachXBT said he funded a new Ethereum address with 349,700 USDC and began exchanging the dollar-linked stablecoin for USDT on Tron through the contact. He accepted unfavorable terms and a reported 5% loss on each completed order to appear credible as a repeat customer. The 349,700 USDC was capital committed to the operation, rather than a disclosed net investigative loss.
The arrangement also exposed him to the possibility that the intermediary could simply keep the funds. That risk reflected a weakness inside the laundering market itself: criminals depend on counterparties who may have no enforceable commercial protections and must instead rely heavily on reputation and personal relationships.
The relationship eventually produced information about planned transactions. In one case, the intermediary discussed moving funds to Solana before the corresponding movement appeared on the blockchain. Comparing those private conversations with later on-chain activity helped ZachXBT connect wallets and identify a wider group of assets allegedly linked to the Bybit theft.
Tracing funds is not the same as recovering them
ZachXBT said the information helped him trace more than $12 million in Bybit-linked funds across multiple networks. He also reported that Tether later froze 442,000 USDT associated with the North Korean hack.
Those figures describe different outcomes. Tracing more than $12 million does not mean all of it was frozen, while freezing 442,000 USDT does not by itself mean the tokens were seized or returned to Bybit. The 442,000 USDT figure and its connection to the investigation come from ZachXBT’s account; Tether has separately disclosed larger freezes related to the Bybit theft.
Stablecoins such as USDT and USDC are issued by centralized entities, which can retain administrative tools to restrict transfers from designated addresses. That creates a possible intervention point while suspected proceeds remain within the issuer’s reach. Bitcoin does not have an issuer-controlled freeze function, although authorities may still restrain assets held by custodians or obtain control of private keys when they have the necessary legal authority and access.
The pursuit becomes more difficult as stolen assets move between wallets, blockchains, custodians and trading counterparties. Investigators may be able to observe the path of funds without having the power to stop the next transaction. Court orders and cooperation from financial intermediaries can restrict assets, but they do not guarantee complete recovery.
A wider market for criminal financial services
The Bybit case sits within a larger enforcement effort aimed at businesses that help criminals convert digital assets into usable funds. In May 2025, the US Financial Crimes Enforcement Network said Cambodia-based Huione Group had laundered at least $4 billion in illicit proceeds between August 2021 and January 2025. The agency identified at least $37 million in cryptocurrency from North Korean cyber thefts, alongside proceeds from investment fraud and cyber scams.
In September, the US Treasury sanctioned Xinbi Guarantee, describing it as a marketplace that had processed more than $24 billion in digital assets and fiat currency through its platforms since roughly 2022. Treasury said North Korean hackers were among the illicit actors reported to have used its services.
The authorities also said criminal users attempted to shift from Huione-related services to Xinbi after earlier sanctions. That movement highlights a central enforcement problem: closing a platform or removing infrastructure does not necessarily eliminate the customers, relationships and demand that support illicit financial services.
In June 2026, the Justice Department announced the seizure of a cloud-computing account allegedly used to host backend infrastructure operated by Huione subsidiaries involved in moving proceeds from fraud, cyber scams and other criminal activity. Treasury also said more than $45 million in USDT across at least 22 Xinbi-linked wallets was frozen. Xinbi reportedly told users it would move toward USDD, a stablecoin structure without the same issuer-controlled address-freezing mechanism as USDT. Authorities also restrained more than $52 million in cryptocurrency during the September action.
These figures cover different platforms, assets and enforcement actions and should not be treated as one pool of recovered Bybit funds. They do, however, show why intermediaries matter: they provide the exchanges, settlement arrangements and payment access required to turn stolen cryptocurrency into purchasing power.
Moneyiar market picture
Moneyiar market data at 11:59 a.m. on Oct. 11, 2026, showed Monad (MON) at $0.0255775941, up 3.68% over 24 hours but down 23.73% over seven days. Decimal (DEL) was $0.3990728079, rising 2.97% in 24 hours and falling 1.41% over seven days.
Billions Network (BILL) was priced at $0.0139971939, down 0.59% over 24 hours and up 10.04% over seven days, while FUNToken (FUN) stood at $0.0087663071, up 0.53% in 24 hours and 11.94% over seven days. The BILL data was timestamped Sept. 21, 2026, at 1:39 a.m.; the other quoted readings were timestamped Oct. 11, 2026, at 11:58 or 11:59 a.m.
ZachXBT’s investigation and the US actions against Huione and Xinbi point to the same underlying constraint. A hacker may gain control of crypto quickly, but using it still requires relationships with people and businesses willing to exchange, settle or disguise the proceeds. Those relationships can make laundering possible, but they also create points where private communications, frozen tokens, sanctions and seized infrastructure can disrupt the operation.
