North Korea's Bybit playbook is dead. Here's the technical breakdown:
Bybit Feb 2025: 400K+ $ETH stolen, 50% laundered in 7 days via THORChain (ETH→BTC bridge), eXch, and OKX Web3 DEX aggregator. Full exit in ~10 days.
Binance Nov 2025: 522K $ETH + 18K $BTC + $161M stables sitting frozen. Day 4 status: 0 transactions, 0 satoshis moved, 0% laundered.
What changed:
• eXch: shut down April 2025 (DOJ whistleblower + transatlantic op)
• OKX DEX aggregator: paused, relaunched with real-time abuse detection
• THORChain: FBI pressuring node operators directly, swaps went dark
• FBI response time: Bybit took 5 days to flag addresses. Binance flagged 600+ addresses within days.
The infrastructure that enabled fast laundering in Feb is now either offline or actively monitored. Hackers are reduced to scraping small amounts on Tron and Solana while $2.8B sits tagged and immovable.
Binance reopened withdrawals, processed $3.64B net outflows, claims 95% impact covered. Users made whole, attackers stuck.
The exit routes got patched in real time. 🔶
Bybit Feb 2025: 400K+ $ETH stolen, 50% laundered in 7 days via THORChain (ETH→BTC bridge), eXch, and OKX Web3 DEX aggregator. Full exit in ~10 days.
Binance Nov 2025: 522K $ETH + 18K $BTC + $161M stables sitting frozen. Day 4 status: 0 transactions, 0 satoshis moved, 0% laundered.
What changed:
• eXch: shut down April 2025 (DOJ whistleblower + transatlantic op)
• OKX DEX aggregator: paused, relaunched with real-time abuse detection
• THORChain: FBI pressuring node operators directly, swaps went dark
• FBI response time: Bybit took 5 days to flag addresses. Binance flagged 600+ addresses within days.
The infrastructure that enabled fast laundering in Feb is now either offline or actively monitored. Hackers are reduced to scraping small amounts on Tron and Solana while $2.8B sits tagged and immovable.
Binance reopened withdrawals, processed $3.64B net outflows, claims 95% impact covered. Users made whole, attackers stuck.
The exit routes got patched in real time. 🔶