Have you ever thought about who would compensate you if, one day, all the coins you have stored on an exchange were completely stolen?
Global trading volume’s third-largest cryptocurrency exchange Bybit has officially announced that it is suing the North Korean government in a U.S. federal court. The defendants are not only hackers, but the entire North Korean state, the Reconnaissance General Bureau under it, and the Lazarus Group—an organization identified by the U.S. government as a North Korean hacking group.
The reason is that, in the February 2025 North Korean cyberattack on Bybit, losses were about $1.5 billion (around NT$48.3 billion), making it one of the largest thefts in the history of cryptocurrencies.
And according to Bybit’s official press release, the U.S. Federal District Court for the District of Columbia has already approved a freezing order, prohibiting the defendant from using the proceeds of the crime that have been traced so far. The court also stated in its ruling that there is a fairly high chance that Bybit will prevail.
Although within a few days after the incident, Bybit covered the entire gap by bringing in emergency loans and large deposits sourced from several institutions, and a reserve proof provided by the third-party cybersecurity firm Hacken also confirmed that the assets in Bybit’s accounts were still sufficient to compensate all users’ deposits (according to CNBC’s report on February 24, 2025).
But how much of that stolen money has been recovered after a year and a half?
According to the latest figures provided by the authorities, about $48.4 million has been recovered. In addition, roughly $30.5 million has been frozen. Together, that’s only about 5% of the total amount stolen—while the remaining 95% still hasn’t been returned as of now.
It’s worth noting that the flow of money can be seen on the blockchain, but seeing it doesn’t mean you can get it back. That’s also why Bybit chose to directly sue a sovereign state later on: what can be done via the chain is limited, but even if the court eventually rules that Bybit wins, how the judgment is enforced is another matter.
Based on my observations, what Taiwanese users truly need to remember from this isn’t how skilled North Korean hackers are—it’s this: on the blockchain, which exchange can we really trust? The answer is: don’t completely trust any single one!
In the cryptocurrency market, try being a bit of a flirt—don’t put all your assets into a single exchange, wallet, or coin. You must have the concept of “asset diversification,” and that’s the best way to protect yourself.
Bybit can afford it because its scale is large enough, and it also wants to keep doing business. But if you switch to a smaller exchange and something similar happens, users’ funds may not be recoverable.
Returning to Taiwan’s regulatory framework: although the Legislative Yuan passed the (Virtual Asset Service Act) in its third reading on June 30 this year, upgrading exchanges from the previous anti–money laundering registration regime to a special industry requiring permission from the Financial Supervisory Commission, the related subsidiary regulations will be completed as early as 2027. At the earliest, official licenses may only be rolled out by the end of the first quarter of 2028.
Some people might say, then just keep your own funds—transfer the coins to your own wallet.
But for someone who has just started interacting with cryptocurrencies, the risk of self-custody isn’t necessarily lower. Forgetting a password, losing a cold wallet, or even misplacing the seed phrase—these kinds of accidents can leave you with nowhere to turn for help.
Where is your crypto mainly stored right now? If you’ve put everything in one exchange, today is a good time to spread it out.
Feel free to share with me~
⚠️ The content above is for reference only and does not constitute any investment advice.