{"id":553171,"date":"2026-08-08T15:10:51","date_gmt":"2026-08-08T14:10:51","guid":{"rendered":"https:\/\/cryptoslate.com\/?p=553171"},"modified":"2026-08-08T12:06:40","modified_gmt":"2026-08-08T11:06:40","slug":"this-1-5-billion-hack-is-exposing-just-how-irreversible-stolen-crypto-really-is","status":"publish","type":"post","link":"https:\/\/cryptoslate.com\/this-1-5-billion-hack-is-exposing-just-how-irreversible-stolen-crypto-really-is\/","title":{"rendered":"This $1.5 billion hack is exposing just how \u2018irreversible\u2019 stolen crypto really is"},"content":{"rendered":"

Bybit sued North Korea, its Reconnaissance General Bureau, and Lazarus Group in the US District Court for the District of Columbia. The exchange won a preliminary injunction blocking unnamed defendants from moving or selling stolen crypto.<\/p>\n

Public court reporting describes the order as covering those identified assets, without confirming the full $1.5 billion stolen in February 2025 or disclosing the dollar value the injunction protects.<\/p>\n

This injunction landed roughly 532 days after the hack\u2014about 17 months after North Korean hackers pulled off the largest crypto theft on record. Chainalysis<\/a> tracked a consistent laundering pattern by DPRK-linked groups after a major theft, moving stolen funds through exchanges<\/a>, bridges, mixers, and laundering services over roughly 45 days.<\/p>\n

Coordinated action by industry partners froze $42.9 million in the first days after the theft, and mETH Protocol recovered another 15,000 cmETH, worth nearly $43 million. Combined, that early save came to about $85.9 million, roughly 5.9% of the $1.46 billion stolen<\/a>.<\/p>\n

Elliptic<\/a>, citing a six-month review from zeroShadow, said more than $1 billion of the stolen funds had already moved<\/a> through the laundering pipeline well before this new court order existed.<\/p>\n

Whatever value the injunction protects now probably represents a small residue that never fully escaped that pipeline.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n
Event \/ metric<\/th>\nFigure<\/th>\nWhat it shows<\/th>\n<\/tr>\n<\/thead>\n
Bybit hack date<\/td>\nFeb. 21, 2025<\/td>\nStarting point of the largest crypto theft on record<\/td>\n<\/tr>\n
Reported court injunction timing<\/td>\n~532 days later<\/td>\nLegal process arrived roughly 17 months after the theft<\/td>\n<\/tr>\n
DPRK laundering cycle<\/td>\n~45 days<\/td>\nStolen funds often move through the main laundering pipeline far faster than courts move<\/td>\n<\/tr>\n
Early frozen funds<\/td>\n$42.9 million<\/td>\nIndustry coordination worked immediately after the hack<\/td>\n<\/tr>\n
cmETH recovered<\/td>\n~$43 million<\/td>\nToken\/protocol-level recovery was possible early<\/td>\n<\/tr>\n
Total early save<\/td>\n~$85.9 million<\/td>\nRoughly 5.9% of the $1.46 billion theft<\/td>\n<\/tr>\n
Funds reportedly laundered by six-month mark<\/td>\n$1 billion+<\/td>\nMost value likely moved before the new injunction existed<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Why a blockchain never has to reverse anything<\/h2>\n

Stolen crypto becomes stoppable the moment it lands somewhere a court order can reach: an exchange, a stablecoin issuer<\/a>, a custodian, or any other operator capable of freezing what passes through it.<\/p>\n

That is why the FBI asked exchanges, bridges and RPC operators to block Lazarus-linked transactions within days of the hack. It is also why Bybit's<\/a> own stolen stETH<\/a> and cmETH were swapped into native ETH<\/a> almost immediately.<\/p>\n

Elliptic says token issuers can often freeze wallets holding their own tokens, but no central party directly controls ETH or Bitcoin<\/a> balances. Converting stolen liquid-staking tokens into native ETH removes one of the easiest tools available to victims for freezing assets.<\/p>\n

Native ETH or Bitcoin sitting in self-custody is nearly impossible to freeze directly, while stablecoins sit at the other end, since issuers can blocklist addresses depending on the chain and contract design.<\/p>\n

Centralized exchanges sit close behind, able to block withdrawals or comply with a warrant. Bridges, swap services and DAO-controlled recovery wallets fall somewhere in between, and OTC brokers operating across borders remain the hardest targets of all.<\/p>\n

A Lazarus-linked theft from the crypto platform Rain drew a similar response. The FBI froze roughly 2,204 SOL at the exchange WhiteBIT<\/a> and served a seizure warrant. WhiteBIT transferred the funds to the US government<\/a>, and a federal court later granted default judgment forfeiting the crypto outright.<\/p>\n\n\n\n\n\n\n\n\n\n\n
Asset location<\/th>\nFreeze difficulty<\/th>\nWho can act<\/th>\nWhy it matters<\/th>\n<\/tr>\n<\/thead>\n
Native ETH or BTC in self-custody<\/td>\nVery hard<\/td>\nNo central controller<\/td>\nTransactions are irreversible and balances cannot be directly frozen by an issuer<\/td>\n<\/tr>\n
Liquid-staking tokens<\/td>\nMedium<\/td>\nToken issuer \/ protocol operator<\/td>\nIssuers or protocols may have tools to block or recover some assets<\/td>\n<\/tr>\n
Stablecoins<\/td>\nLower<\/td>\nStablecoin issuer<\/td>\nIssuers can often blocklist addresses depending on contract design<\/td>\n<\/tr>\n
Centralized exchanges<\/td>\nLower<\/td>\nExchange \/ law enforcement<\/td>\nExchanges can freeze withdrawals or comply with seizure warrants<\/td>\n<\/tr>\n
Bridges and swap services<\/td>\nMixed<\/td>\nOperator, DAO, court, or governance process<\/td>\nDepends on control structure and jurisdiction<\/td>\n<\/tr>\n
OTC brokers<\/td>\nVery hard<\/td>\nLaw enforcement, sanctions authorities<\/td>\nCross-border laundering makes recovery slower and less predictable<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

A second fight brewing over who gets frozen funds<\/h2>\n

Holders of old terrorism judgments against North Korea served a restraining notice on roughly 30,766 ETH, worth about $71 million, that had been frozen when an unrelated exploit hit the Kelp protocol on Arbitrum.<\/p>\n

Arbitrum's governance records show a DAO vote that later moved ETH to an Aave-controlled wallet, with the restraining notice accompanying the assets to their new location.<\/p>\n

No public record shows that competing creditors have claimed the assets Bybit is now pursuing, though the Kelp episode establishes a real pattern. Once DPRK-linked crypto sits frozen somewhere reachable, other parties holding judgments against North Korea can try to get in line for it too.<\/p>\n

The US Treasury Department designated Lazarus Group, Bluenoroff and Andariel in 2019 as entities controlled by North Korea<\/a> through their ties to the Reconnaissance General Bureau. Treasury says the country's cyber operations generate revenue that can fund weapons and ballistic missile programs.<\/p>\n

Chainalysis says North Korean hackers stole over $2 billion in crypto in 2025<\/a> alone, a 51% jump from the year before, even as the number of known attacks fell sharply.<\/p>\n

Cumulative DPRK crypto theft has reached at least $6.75 billion, and the pattern points toward fewer, larger hits and away from a broad spray of small ones.<\/p>\n

What happens to the crypto from here<\/h2>\n

The bull case is that more of the stolen $1.46 billion will turn up at reachable chokepoints than anyone currently expects.<\/p>\n

Investigators trace additional funds held by exchanges, stablecoin issuers, bridges, or custodians willing to cooperate, and Bybit's injunction becomes a template other victims use to chase down DPRK-linked funds long into a hack's aftermath.<\/p>\n

Recovery climbs meaningfully above the roughly $85.9 million secured so far, and courts prove that persistence still beats time even against a state-backed hacking operation.<\/p>\n

The bear case is that the injunction covers only a small residual balance already trapped by ordinary compliance systems before Bybit filed suit.<\/p>\n

Most of the $1.46 billion stays gone, laundered through the 45-day window Chainalysis describes long before any court could act.<\/p>\n\n\n\n\n\n\n\n\n
Scenario<\/th>\nWhat happens next<\/th>\nRecovery implication<\/th>\nBroader market meaning<\/th>\n<\/tr>\n<\/thead>\n
Bull case<\/strong><\/td>\nMore funds surface at exchanges, bridges, stablecoin issuers, or custodians<\/td>\nRecovery rises meaningfully above the ~$85.9 million already frozen or recovered<\/td>\nCourts prove stolen crypto can remain reachable long after a hack<\/td>\n<\/tr>\n
Base case<\/strong><\/td>\nThe injunction preserves only identified residual assets<\/td>\nBybit recovers some funds, but not close to the full $1.46 billion<\/td>\nLegal tools work, but mostly at the edges after funds are laundered<\/td>\n<\/tr>\n
Bear case<\/strong><\/td>\nMost funds remain beyond reach after the 45-day laundering window<\/td>\nThe lawsuit becomes more about accountability than recovery<\/td>\nA 17-month delay looks nearly fatal to meaningful restitution<\/td>\n<\/tr>\n
Competing-claim risk<\/strong><\/td>\nOther creditors of North Korea try to claim frozen DPRK-linked assets<\/td>\nRecovery becomes a priority fight, not just a tracing fight<\/td>\nFrozen crypto may become contested sovereign-linked property<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The lawsuit proves that legal reach exists<\/a>, but it also proves that a 17-month head start is nearly fatal to recovery, whatever it says about accountability.<\/p>\n

Bybit's lawsuit is proving that the assets sitting at the end of one blockchain transaction can still be stopped, just not for free and never on a predictable schedule.<\/p>\n","protected":false},"excerpt":{"rendered":"

Bybit sued North Korea, its Reconnaissance General Bureau, and Lazarus Group in the US District Court for the District of Columbia. The exchange won a preliminary injunction blocking unnamed defendants from moving or selling stolen crypto. Public court reporting describes the order as covering those identified assets, without confirming the full $1.5 billion stolen in […]<\/p>\n","protected":false},"author":1511,"featured_media":553284,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[39,77968,16041,60793],"tags":[],"prediction_market_topic":[],"post_folder":[],"acf":[],"yoast_head":"\nThis $1.5 billion hack is exposing just how \u2018irreversible\u2019 stolen crypto really is<\/title>\n<meta name=\"description\" content=\"Bybit\u2019s $1.5 billion North Korea case tests how far courts can trace, freeze and recover stolen crypto after months of laundering.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptoslate.com\/this-1-5-billion-hack-is-exposing-just-how-irreversible-stolen-crypto-really-is\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"This $1.5 billion hack is exposing just how \u2018irreversible\u2019 stolen crypto really is\" \/>\n<meta property=\"og:description\" content=\"Bybit\u2019s $1.5 billion North Korea case tests how far courts can trace, freeze and recover stolen crypto after months of laundering.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptoslate.com\/this-1-5-billion-hack-is-exposing-just-how-irreversible-stolen-crypto-really-is\/\" \/>\n<meta property=\"og:site_name\" content=\"CryptoSlate\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-08T14:10:51+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-08T11:06:40+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/08\/lazarus-crypto-laundering-pipeline.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Gino Matos\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@cryptoslate\" \/>\n<meta name=\"twitter:site\" content=\"@cryptoslate\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Gino Matos\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\/\/cryptoslate.com\/this-1-5-billion-hack-is-exposing-just-how-irreversible-stolen-crypto-really-is\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/cryptoslate.com\/this-1-5-billion-hack-is-exposing-just-how-irreversible-stolen-crypto-really-is\/\"},\"author\":{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptoslate.com\/author\/gino-matos\/#person\",\"name\":\"Gino Matos\",\"url\":\"https:\/\/cryptoslate.com\/author\/gino-matos\/\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/cryptoslate.com\/author\/gino-matos\/\"},\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/cryptoslate.com\/author\/gino-matos\/#authorimage\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/profile-photo-gino-300x300.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/profile-photo-gino-300x300.jpg\",\"caption\":\"Gino Matos\"},\"jobTitle\":\"Reporter\",\"description\":\"Gino Matos is a seasoned crypto journalist and law graduate covering Brazil\u2019s blockchain ecosystem and DeFi developments.\",\"worksFor\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"sameAs\":[\"https:\/\/x.com\/pelicamatos\",\"https:\/\/www.linkedin.com\/in\/ginomatos\",\"https:\/\/muckrack.com\/gino-matos\"]},\"headline\":\"This $1.5 billion hack is exposing just how \u2018irreversible\u2019 stolen crypto really is\",\"datePublished\":\"2026-08-08T14:10:51+00:00\",\"dateModified\":\"2026-08-08T14:10:51+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/cryptoslate.com\/this-1-5-billion-hack-is-exposing-just-how-irreversible-stolen-crypto-really-is\/\"},\"wordCount\":1175,\"publisher\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"articleSection\":[\"Exchanges\",\"Featured\",\"Hacks\",\"Legal\"],\"inLanguage\":\"en-US\",\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptoslate.com\/this-1-5-billion-hack-is-exposing-just-how-irreversible-stolen-crypto-really-is\/\",\"url\":\"https:\/\/cryptoslate.com\/this-1-5-billion-hack-is-exposing-just-how-irreversible-stolen-crypto-really-is\/\",\"name\":\"This $1.5 billion hack is exposing just how \u2018irreversible\u2019 stolen crypto really is\",\"isPartOf\":{\"@id\":\"https:\/\/cryptoslate.com\/#website\"},\"datePublished\":\"2026-08-08T14:10:51+00:00\",\"dateModified\":\"2026-08-08T14:10:51+00:00\",\"description\":\"Bybit\u2019s $1.5 billion North Korea case tests how far courts can trace, freeze and recover stolen crypto after months of laundering.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptoslate.com\/this-1-5-billion-hack-is-exposing-just-how-irreversible-stolen-crypto-really-is\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptoslate.com\/this-1-5-billion-hack-is-exposing-just-how-irreversible-stolen-crypto-really-is\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptoslate.com\/this-1-5-billion-hack-is-exposing-just-how-irreversible-stolen-crypto-really-is\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptoslate.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"This $1.5 billion hack is exposing just how \u2018irreversible\u2019 stolen crypto really is\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptoslate.com\/#website\",\"url\":\"https:\/\/cryptoslate.com\/\",\"name\":\"CryptoSlate\",\"description\":\"Cryptocurrency News and Real-time Coin Data\",\"publisher\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"inLanguage\":\"en-US\"},{\"@type\":\"NewsMediaOrganization\",\"@id\":\"https:\/\/cryptoslate.com\/#organization\",\"name\":\"CryptoSlate\",\"url\":\"https:\/\/cryptoslate.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg\",\"width\":1000,\"height\":1000,\"caption\":\"CryptoSlate\"},\"image\":{\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/twitter.com\/cryptoslate\",\"https:\/\/www.instagram.com\/cryptoslate\",\"https:\/\/www.linkedin.com\/company\/cryptoslate\",\"https:\/\/www.youtube.com\/c\/cryptoslate\",\"https:\/\/cryptoslate.substack.com\",\"https:\/\/t.me\/cryptoslatenews\",\"https:\/\/www.crunchbase.com\/organization\/cryptoslate\",\"https:\/\/iq.wiki\/wiki\/cryptoslate\",\"https:\/\/news.google.com\/publications\/CAAqKggKIiRDQklTRlFnTWFoRUtEMk55ZVhCMGIzTnNZWFJsTG1OdmJTZ0FQAQ\",\"https:\/\/muckrack.com\/media-outlet\/cryptoslate\",\"https:\/\/www.tiktok.com\/@cryptoslatenews\"],\"publishingPrinciples\":\"https:\/\/cryptoslate.com\/editorial-policy\/#editorial-principles\",\"ownershipFundingInfo\":\"https:\/\/cryptoslate.com\/disclaimers\/how-cryptoslate-makes-and-spends-money\/\",\"correctionsPolicy\":\"https:\/\/cryptoslate.com\/editorial-policy\/#corrections-feedback\",\"ethicsPolicy\":\"https:\/\/cryptoslate.com\/editorial-policy\/#editorial-principles\",\"foundingDate\":\"2017-08-04\",\"founder\":[{\"@type\":\"Person\",\"name\":\"Nate Whitehill\"},{\"@type\":\"Person\",\"name\":\"Matthew Blancarte\"}],\"contactPoint\":[{\"@type\":\"ContactPoint\",\"contactType\":\"customer support\",\"url\":\"https:\/\/cryptoslate.com\/contact\/\",\"availableLanguage\":\"en-US\"},{\"@type\":\"ContactPoint\",\"contactType\":\"sales\",\"url\":\"https:\/\/cryptoslate.com\/advertising\/\",\"availableLanguage\":\"en-US\"},{\"@type\":\"ContactPoint\",\"contactType\":\"newsroom\",\"url\":\"https:\/\/cryptoslate.com\/editorial-policy\/#corrections-feedback\",\"email\":\"tips@cryptoslate.com\",\"availableLanguage\":\"en-US\"}],\"masthead\":\"https:\/\/cryptoslate.com\/about\/#masthead\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/person\/f03754c9e579651795caf77a2b00c49c\",\"name\":\"Gino Matos\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/profile-photo-gino-150x150.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/profile-photo-gino-150x150.jpg\",\"caption\":\"Gino Matos\"},\"description\":\"Gino Matos is a law school graduate and a seasoned journalist with six years of experience in the crypto industry. His expertise primarily focuses on the Brazilian blockchain ecosystem and developments in decentralized finance (DeFi).\",\"url\":\"https:\/\/cryptoslate.com\/author\/gino-matos\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"This $1.5 billion hack is exposing just how \u2018irreversible\u2019 stolen crypto really is","description":"Bybit\u2019s $1.5 billion North Korea case tests how far courts can trace, freeze and recover stolen crypto after months of laundering.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptoslate.com\/this-1-5-billion-hack-is-exposing-just-how-irreversible-stolen-crypto-really-is\/","og_locale":"en_US","og_type":"article","og_title":"This $1.5 billion hack is exposing just how \u2018irreversible\u2019 stolen crypto really is","og_description":"Bybit\u2019s $1.5 billion North Korea case tests how far courts can trace, freeze and recover stolen crypto after months of laundering.","og_url":"https:\/\/cryptoslate.com\/this-1-5-billion-hack-is-exposing-just-how-irreversible-stolen-crypto-really-is\/","og_site_name":"CryptoSlate","article_published_time":"2026-08-08T14:10:51+00:00","article_modified_time":"2026-08-08T11:06:40+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/08\/lazarus-crypto-laundering-pipeline.jpg","type":"image\/jpeg"}],"author":"Gino Matos","twitter_card":"summary_large_image","twitter_creator":"@cryptoslate","twitter_site":"@cryptoslate","twitter_misc":{"Written by":"Gino Matos","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/cryptoslate.com\/this-1-5-billion-hack-is-exposing-just-how-irreversible-stolen-crypto-really-is\/#article","isPartOf":{"@id":"https:\/\/cryptoslate.com\/this-1-5-billion-hack-is-exposing-just-how-irreversible-stolen-crypto-really-is\/"},"author":{"@type":"Person","@id":"https:\/\/cryptoslate.com\/author\/gino-matos\/#person","name":"Gino Matos","url":"https:\/\/cryptoslate.com\/author\/gino-matos\/","mainEntityOfPage":{"@id":"https:\/\/cryptoslate.com\/author\/gino-matos\/"},"image":{"@type":"ImageObject","@id":"https:\/\/cryptoslate.com\/author\/gino-matos\/#authorimage","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/profile-photo-gino-300x300.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/profile-photo-gino-300x300.jpg","caption":"Gino Matos"},"jobTitle":"Reporter","description":"Gino Matos is a seasoned crypto journalist and law graduate covering Brazil\u2019s blockchain ecosystem and DeFi developments.","worksFor":{"@id":"https:\/\/cryptoslate.com\/#organization"},"sameAs":["https:\/\/x.com\/pelicamatos","https:\/\/www.linkedin.com\/in\/ginomatos","https:\/\/muckrack.com\/gino-matos"]},"headline":"This $1.5 billion hack is exposing just how \u2018irreversible\u2019 stolen crypto really is","datePublished":"2026-08-08T14:10:51+00:00","dateModified":"2026-08-08T14:10:51+00:00","mainEntityOfPage":{"@id":"https:\/\/cryptoslate.com\/this-1-5-billion-hack-is-exposing-just-how-irreversible-stolen-crypto-really-is\/"},"wordCount":1175,"publisher":{"@id":"https:\/\/cryptoslate.com\/#organization"},"articleSection":["Exchanges","Featured","Hacks","Legal"],"inLanguage":"en-US","copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/cryptoslate.com\/#organization"}},{"@type":"WebPage","@id":"https:\/\/cryptoslate.com\/this-1-5-billion-hack-is-exposing-just-how-irreversible-stolen-crypto-really-is\/","url":"https:\/\/cryptoslate.com\/this-1-5-billion-hack-is-exposing-just-how-irreversible-stolen-crypto-really-is\/","name":"This $1.5 billion hack is exposing just how \u2018irreversible\u2019 stolen crypto really is","isPartOf":{"@id":"https:\/\/cryptoslate.com\/#website"},"datePublished":"2026-08-08T14:10:51+00:00","dateModified":"2026-08-08T14:10:51+00:00","description":"Bybit\u2019s $1.5 billion North Korea case tests how far courts can trace, freeze and recover stolen crypto after months of laundering.","breadcrumb":{"@id":"https:\/\/cryptoslate.com\/this-1-5-billion-hack-is-exposing-just-how-irreversible-stolen-crypto-really-is\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptoslate.com\/this-1-5-billion-hack-is-exposing-just-how-irreversible-stolen-crypto-really-is\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/cryptoslate.com\/this-1-5-billion-hack-is-exposing-just-how-irreversible-stolen-crypto-really-is\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptoslate.com\/"},{"@type":"ListItem","position":2,"name":"This $1.5 billion hack is exposing just how \u2018irreversible\u2019 stolen crypto really is"}]},{"@type":"WebSite","@id":"https:\/\/cryptoslate.com\/#website","url":"https:\/\/cryptoslate.com\/","name":"CryptoSlate","description":"Cryptocurrency News and Real-time Coin Data","publisher":{"@id":"https:\/\/cryptoslate.com\/#organization"},"inLanguage":"en-US"},{"@type":"NewsMediaOrganization","@id":"https:\/\/cryptoslate.com\/#organization","name":"CryptoSlate","url":"https:\/\/cryptoslate.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg","width":1000,"height":1000,"caption":"CryptoSlate"},"image":{"@id":"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/twitter.com\/cryptoslate","https:\/\/www.instagram.com\/cryptoslate","https:\/\/www.linkedin.com\/company\/cryptoslate","https:\/\/www.youtube.com\/c\/cryptoslate","https:\/\/cryptoslate.substack.com","https:\/\/t.me\/cryptoslatenews","https:\/\/www.crunchbase.com\/organization\/cryptoslate","https:\/\/iq.wiki\/wiki\/cryptoslate","https:\/\/news.google.com\/publications\/CAAqKggKIiRDQklTRlFnTWFoRUtEMk55ZVhCMGIzTnNZWFJsTG1OdmJTZ0FQAQ","https:\/\/muckrack.com\/media-outlet\/cryptoslate","https:\/\/www.tiktok.com\/@cryptoslatenews"],"publishingPrinciples":"https:\/\/cryptoslate.com\/editorial-policy\/#editorial-principles","ownershipFundingInfo":"https:\/\/cryptoslate.com\/disclaimers\/how-cryptoslate-makes-and-spends-money\/","correctionsPolicy":"https:\/\/cryptoslate.com\/editorial-policy\/#corrections-feedback","ethicsPolicy":"https:\/\/cryptoslate.com\/editorial-policy\/#editorial-principles","foundingDate":"2017-08-04","founder":[{"@type":"Person","name":"Nate Whitehill"},{"@type":"Person","name":"Matthew Blancarte"}],"contactPoint":[{"@type":"ContactPoint","contactType":"customer support","url":"https:\/\/cryptoslate.com\/contact\/","availableLanguage":"en-US"},{"@type":"ContactPoint","contactType":"sales","url":"https:\/\/cryptoslate.com\/advertising\/","availableLanguage":"en-US"},{"@type":"ContactPoint","contactType":"newsroom","url":"https:\/\/cryptoslate.com\/editorial-policy\/#corrections-feedback","email":"tips@cryptoslate.com","availableLanguage":"en-US"}],"masthead":"https:\/\/cryptoslate.com\/about\/#masthead"},{"@type":"Person","@id":"https:\/\/cryptoslate.com\/#\/schema\/person\/f03754c9e579651795caf77a2b00c49c","name":"Gino Matos","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptoslate.com\/#\/schema\/person\/image\/","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/profile-photo-gino-150x150.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/profile-photo-gino-150x150.jpg","caption":"Gino Matos"},"description":"Gino Matos is a law school graduate and a seasoned journalist with six years of experience in the crypto industry. His expertise primarily focuses on the Brazilian blockchain ecosystem and developments in decentralized finance (DeFi).","url":"https:\/\/cryptoslate.com\/author\/gino-matos\/"}]}},"_links":{"self":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/553171"}],"collection":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/users\/1511"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/comments?post=553171"}],"version-history":[{"count":4,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/553171\/revisions"}],"predecessor-version":[{"id":553285,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/553171\/revisions\/553285"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/media\/553284"}],"wp:attachment":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/media?parent=553171"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/categories?post=553171"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/tags?post=553171"},{"taxonomy":"prediction_market_topic","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/prediction_market_topic?post=553171"},{"taxonomy":"post_folder","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/post_folder?post=553171"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}