PSA250226, North Korea responsible for $1.5B Bybit theft (contains published ETH addresses; also summarised at sources/hacks/)

Bitcoin Research — Law, Regulation, Markets & Origins (2026)

Exchanges

2025-02-26

📷 View Wayback snapshot (2025-02-26) ↗ Live URL (may be dead)

Document text

Research, not advice. Part of the Bitcoin research archive (October 2026). Claims labelled unverified, contested or fringe are reported, not endorsed; statuses of bills and rules are as of the date checked. Government, court and patent records are public domain; the research notes are CC BY 4.0.

Internet Crime Complaint Center (IC3) | North Korea Responsible for $1.5 Billion Bybit Hack

        Skip to main

Alert Number: I-022625-PSA
                February 26, 2025

North Korea Responsible for $1.5 Billion Bybit Hack

The Federal Bureau of Investigation (FBI) is releasing this PSA to advise the Democratic People's Republic of Korea (North Korea) was responsible for the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange, Bybit, on or about February 21, 2025. FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor."

TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets to Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains. It is expected these assets will be further laundered and eventually converted to fiat currency.

How You Can Help:

FBI encourages private sector entities including RPC node operators, exchanges, bridges, blockchain analytics firms, DeFi services, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder the stolen assets.

The following Ethereum addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

0x51E9d833Ecae4E8D9D8Be17300AEE6D3398C135D

0x96244D83DC15d36847C35209bBDc5bdDE9bEc3D8

0x83c7678492D623fb98834F0fbcb2E7b7f5Af8950

0x83Ef5E80faD88288F770152875Ab0bb16641a09E

0xAF620E6d32B1c67f3396EF5d2F7d7642Dc2e6CE9

0x3A21F4E6Bbe527D347ca7c157F4233c935779847

0xfa3FcCCB897079fD83bfBA690E7D47Eb402d6c49

0xFc926659Dd8808f6e3e0a8d61B20B871F3Fa6465

0xb172F7e99452446f18FF49A71bfEeCf0873003b4

0x6d46bd3AfF100f23C194e5312f93507978a6DC91

0xf0a16603289eAF35F64077Ba3681af41194a1c09

0x23Db729908137cb60852f2936D2b5c6De0e1c887

0x40e98FeEEbaD7Ddb0F0534Ccaa617427eA10187e

0x140c9Ab92347734641b1A7c124ffDeE58c20C3E3

0x684d4b58Dc32af786BF6D572A792fF7A883428B9

0xBC3e5e8C10897a81b63933348f53f2e052F89a7E

0x5Af75eAB6BEC227657fA3E749a8BFd55f02e4b1D

0xBCA02B395747D62626a65016F2e64A20bd254A39

0x4C198B3B5F3a4b1Aa706daC73D826c2B795ccd67

0xCd7eC020121Ead6f99855cbB972dF502dB5bC63a

0xbdE2Cc5375fa9E0383309A2cA31213f2D6cabcbd

0xD3C611AeD139107DEC2294032da3913BC26507fb

0xB72334cB9D0b614D30C4c60e2bd12fF5Ed03c305

0x8c7235e1A6EeF91b980D0FcA083347FBb7EE1806

0x1bb0970508316DC735329752a4581E0a4bAbc6B4

0x1eB27f136BFe7947f80d6ceE3Cf0bfDf92b45e57

0xCd1a4A457cA8b0931c3BF81Df3CFa227ADBdb6E9

0x09278b36863bE4cCd3d0c22d643E8062D7a11377

0x660BfcEa3A5FAF823e8f8bF57dd558db034dea1d

0xE9bc552fdFa54b30296d95F147e3e0280FF7f7e6

0x30a822CDD2782D2B2A12a08526452e885978FA1D

0xB4a862A81aBB2f952FcA4C6f5510962e18c7f1A2

0x0e8C1E2881F35Ef20343264862A242FB749d6b35

0x9271EDdda0F0f2bB7b1A0c712bdF8dbD0A38d1Ab

0xe69753Ddfbedbd249E703EB374452E78dae1ae49

0x2290937A4498C96eFfb87b8371a33D108F8D433f

0x959c4CA19c4532C97A657D82d97acCBAb70e6fb4

0x52207Ec7B1b43AA5DB116931a904371ae2C1619e

0x9eF42873Ae015AA3da0c4354AeF94a18D2B3407b

0x1542368a03ad1f03d96D51B414f4738961Cf4443

0x21032176B43d9f7E9410fB37290a78f4fEd6044C

0xA4B2Fd68593B6F34E51cB9eDB66E71c1B4Ab449e

0x55CCa2f5eB07907696afe4b9Db5102bcE5feB734

0xA5A023E052243b7cce34Cbd4ba20180e8Dea6Ad6

0xdD90071D52F20e85c89802e5Dc1eC0A7B6475f92

0x1512fcb09463A61862B73ec09B9b354aF1790268

0xF302572594a68aA8F951faE64ED3aE7DA41c72Be

0x723a7084028421994d4a7829108D63aB44658315

0xf03AfB1c6A11A7E370920ad42e6eE735dBedF0b1

0xEB0bAA3A556586192590CAD296b1e48dF62a8549

0xD5b58Cf7813c1eDC412367b97876bD400ea5c489

Reporting

FBI maintains its commitment to protecting the virtual asset community by identifying, mitigating, and disrupting North Korea's illicit cybercrime and virtual asset theft activities.  If you have any information to provide, please contact your local FBI field office or FBI's Internet Crime Complaint Center at ic3.gov.