North Korea Responsible for $1.5 Billion Bybit Hack (Alert I-022625-PSA)

Bitcoin Research — Law, Regulation, Markets & Origins (2026)

Hacks

2025-02-26

📷 View Wayback snapshot (2025-02-26) ↗ Live URL (may be dead)

Document text

Research, not advice. Part of the Bitcoin research archive (October 2026). Claims labelled unverified, contested or fringe are reported, not endorsed; statuses of bills and rules are as of the date checked. Government, court and patent records are public domain; the research notes are CC BY 4.0.

# North Korea Responsible for $1.5 Billion Bybit Hack (Alert I-022625-PSA)

- Issuer: FBI Internet Crime Complaint Center (IC3)
- Date: 2025-02-26
- URL: https://www.ic3.gov/PSA/2025/PSA250226
- Retrieved: 2026-10-09
- Status: US federal government work (public domain). Full text below, extracted from the HTML page; navigation and boilerplate removed.

---

The Federal Bureau of Investigation (FBI) is releasing this PSA to advise the Democratic People's Republic of Korea (North Korea) was responsible for the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange, Bybit, on or about February 21, 2025. FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor."

TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets to Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains. It is expected these assets will be further laundered and eventually converted to fiat currency.

## How You Can Help:

FBI encourages private sector entities including RPC node operators, exchanges, bridges, blockchain analytics firms, DeFi services, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder the stolen assets.

The following Ethereum addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

- 0x51E9d833Ecae4E8D9D8Be17300AEE6D3398C135D

- 0x96244D83DC15d36847C35209bBDc5bdDE9bEc3D8

- 0x83c7678492D623fb98834F0fbcb2E7b7f5Af8950

- 0x83Ef5E80faD88288F770152875Ab0bb16641a09E

- 0xAF620E6d32B1c67f3396EF5d2F7d7642Dc2e6CE9

- 0x3A21F4E6Bbe527D347ca7c157F4233c935779847

- 0xfa3FcCCB897079fD83bfBA690E7D47Eb402d6c49

- 0xFc926659Dd8808f6e3e0a8d61B20B871F3Fa6465

- 0xb172F7e99452446f18FF49A71bfEeCf0873003b4

- 0x6d46bd3AfF100f23C194e5312f93507978a6DC91

- 0xf0a16603289eAF35F64077Ba3681af41194a1c09

- 0x23Db729908137cb60852f2936D2b5c6De0e1c887

- 0x40e98FeEEbaD7Ddb0F0534Ccaa617427eA10187e

- 0x140c9Ab92347734641b1A7c124ffDeE58c20C3E3

- 0x684d4b58Dc32af786BF6D572A792fF7A883428B9

- 0xBC3e5e8C10897a81b63933348f53f2e052F89a7E

- 0x5Af75eAB6BEC227657fA3E749a8BFd55f02e4b1D

- 0xBCA02B395747D62626a65016F2e64A20bd254A39

- 0x4C198B3B5F3a4b1Aa706daC73D826c2B795ccd67

- 0xCd7eC020121Ead6f99855cbB972dF502dB5bC63a

- 0xbdE2Cc5375fa9E0383309A2cA31213f2D6cabcbd

- 0xD3C611AeD139107DEC2294032da3913BC26507fb

- 0xB72334cB9D0b614D30C4c60e2bd12fF5Ed03c305

- 0x8c7235e1A6EeF91b980D0FcA083347FBb7EE1806

- 0x1bb0970508316DC735329752a4581E0a4bAbc6B4

- 0x1eB27f136BFe7947f80d6ceE3Cf0bfDf92b45e57

- 0xCd1a4A457cA8b0931c3BF81Df3CFa227ADBdb6E9

- 0x09278b36863bE4cCd3d0c22d643E8062D7a11377

- 0x660BfcEa3A5FAF823e8f8bF57dd558db034dea1d

- 0xE9bc552fdFa54b30296d95F147e3e0280FF7f7e6

- 0x30a822CDD2782D2B2A12a08526452e885978FA1D

- 0xB4a862A81aBB2f952FcA4C6f5510962e18c7f1A2

- 0x0e8C1E2881F35Ef20343264862A242FB749d6b35

- 0x9271EDdda0F0f2bB7b1A0c712bdF8dbD0A38d1Ab

- 0xe69753Ddfbedbd249E703EB374452E78dae1ae49

- 0x2290937A4498C96eFfb87b8371a33D108F8D433f

- 0x959c4CA19c4532C97A657D82d97acCBAb70e6fb4

- 0x52207Ec7B1b43AA5DB116931a904371ae2C1619e

- 0x9eF42873Ae015AA3da0c4354AeF94a18D2B3407b

- 0x1542368a03ad1f03d96D51B414f4738961Cf4443

- 0x21032176B43d9f7E9410fB37290a78f4fEd6044C

- 0xA4B2Fd68593B6F34E51cB9eDB66E71c1B4Ab449e

- 0x55CCa2f5eB07907696afe4b9Db5102bcE5feB734

- 0xA5A023E052243b7cce34Cbd4ba20180e8Dea6Ad6

- 0xdD90071D52F20e85c89802e5Dc1eC0A7B6475f92

- 0x1512fcb09463A61862B73ec09B9b354aF1790268

- 0xF302572594a68aA8F951faE64ED3aE7DA41c72Be

- 0x723a7084028421994d4a7829108D63aB44658315

- 0xf03AfB1c6A11A7E370920ad42e6eE735dBedF0b1

- 0xEB0bAA3A556586192590CAD296b1e48dF62a8549

- 0xD5b58Cf7813c1eDC412367b97876bD400ea5c489

## Reporting

FBI maintains its commitment to protecting the virtual asset community by identifying, mitigating, and disrupting North Korea's illicit cybercrime and virtual asset theft activities. If you have any information to provide, please contact your local FBI field office or FBI's Internet Crime Complaint Center at ic3.gov.