H
Harry Hood
Guest
A public record of a theft should be an investigator’s advantage. In crypto, the difficulty is turning that record into an explanation of who controls the money, where it has gone and whether anyone can stop it moving again.
Popoola Kayode, known professionally as PopeBlack, addresses this in an article, Inside the Hunt for the Bybit Billion: What Happens After Crypto Theft? His focus is tracing value as it changes assets and passes through intermediaries.
The Bybit theft provides a particularly consequential example. Elliptic records that approximately $1.46 billion in ETH and ERC-20 tokens was taken on 21 February 2025. Its six-month review describes repeated transfers between networks and privacy services, with some proceeds eventually converted to USDT on Tron and cashed out through suspected Chinese over-the-counter trading services.
Understanding the recovery problem starts with understanding what the attack compromised. Hacken’s forensic analysis attributes the breach to malicious JavaScript introduced into resources used by the Safe signing interface. The interface concealed the nature of a transaction that authorised signers approved during what appeared to be a routine wallet transfer.
The transaction changed the wallet’s underlying implementation, allowing the attacker to take control and drain assets. Hacken says the incident did not originate in a defect in the smart contract code. Its account points instead to the human and operational systems surrounding the signing process.
The implication for security planning is uncomfortable. Multiple approvals offer limited reassurance if the people providing them are all relying on a compromised view of the transaction. Counting signatures cannot substitute for verifying what those signatures authorise.
Kayode distinguishes visible transaction records from demonstrable connections to a theft. Swaps and bridges leave analysts with additional relationships to establish.
“The investigator, therefore, has to follow the value rather than wait for the original asset to reappear,” Kayode writes.
Elliptic’s August 2025 review gives that argument concrete detail. It describes laundering routes involving multiple rounds of mixing and cross-chain transfers, including movements through less familiar networks and services. It also reports cases in which rejected deposits were refunded to fresh addresses rather than the sending wallet, complicating the expected trail.
Elliptic cites a zeroShadow report estimating that more than $1 billion had been laundered by that point. It suggests professional laundering operations may have handled portions of the proceeds, while retaining uncertainty about which actors controlled the funds at different stages.
That uncertainty matters. A diagram can show a route without, by itself, explaining every participant’s knowledge or intention. For readers assessing an investigation, the useful question is how each connection was established and what evidence supports the conclusion drawn from it.
Chainalysis’s account, updated on 27 February 2025, describes the use of intermediary wallets, asset conversions and cross-chain services following the attack. It also reports helping industry contacts freeze more than $40 million of the stolen funds. That is a dated account of intervention, rather than a current recovery total.
A later example came from Greece. In July 2025, Chainalysis reported that the Hellenic Anti-Money Laundering Authority had traced a portion of the Bybit proceeds and issued a freezing order. According to the company, analysts connected assets in a suspect user’s wallet with the primary wallets involved in the theft. The case was then referred to the prosecuting authority.
These reports describe a sequence with several distinct outcomes: finding relevant transactions, developing evidence, obtaining cooperation or legal authority, and restricting access to assets. A successful step in that sequence does not automatically complete the others.
There is another constraint on intervention. Kayode cautions against equating exposure to stolen funds with responsibility for the theft. Legitimate services and unsuspecting recipients can sit along a transaction path. His warning is that investigators must establish attribution carefully before a connection becomes grounds for action.
Read together, these accounts suggest a more demanding way to assess crypto recovery claims. A report should make clear whether it describes assets being tracked, frozen, seized or returned. It should identify the date of its figures and explain where the evidence ends and an assessment begins.
For an exchange or protocol, the same distinction belongs in incident planning. A team needs to know who can validate suspicious activity, who can contact relevant services and who can pursue the authority required to intervene. A monitoring alert is the beginning of that response.
Kayode’s analysis is valuable because it keeps attention on the work after the headline theft. The public ledger provides evidence; investigators, service providers and authorities still have to turn it into a defensible case and an effective response.
This commentary draws on Popoola Kayode’s article for Hacken, with supporting reporting from the investigations listed below.
Popoola Kayode (PopeBlack), Inside the Hunt for the Bybit Billion: What Happens After Crypto Theft? https://hacken.io/discover/tracing-bybit-billion/
Hacken, Bybit Hack Investigation: The Biggest Crypto Heist in History. https://hacken.io/insights/bybit-hack/
Elliptic, Bybit exploit six months on, 21 August 2025. https://www.elliptic.co/insights/bybit-exploit-six-months-on/
Chainalysis, Bybit Hack: Leveraging Transparency for Collaboration in the Wake of Record-Breaking Theft, updated 27 February 2025. https://www.chainalysis.com/blog/bybit-exchange-hack-february-2025-crypto-security-dprk/
Chainalysis, First-Ever Crypto Seizure in Greece, 9 July 2025. https://www.chainalysis.com/blog/greece-first-ever-crypto-seizure-bybit-hack-2025/
Popoola Kayode, known professionally as PopeBlack, addresses this in an article, Inside the Hunt for the Bybit Billion: What Happens After Crypto Theft? His focus is tracing value as it changes assets and passes through intermediaries.
The Bybit theft provides a particularly consequential example. Elliptic records that approximately $1.46 billion in ETH and ERC-20 tokens was taken on 21 February 2025. Its six-month review describes repeated transfers between networks and privacy services, with some proceeds eventually converted to USDT on Tron and cashed out through suspected Chinese over-the-counter trading services.
Where the security failed
Understanding the recovery problem starts with understanding what the attack compromised. Hacken’s forensic analysis attributes the breach to malicious JavaScript introduced into resources used by the Safe signing interface. The interface concealed the nature of a transaction that authorised signers approved during what appeared to be a routine wallet transfer.
The transaction changed the wallet’s underlying implementation, allowing the attacker to take control and drain assets. Hacken says the incident did not originate in a defect in the smart contract code. Its account points instead to the human and operational systems surrounding the signing process.
The implication for security planning is uncomfortable. Multiple approvals offer limited reassurance if the people providing them are all relying on a compromised view of the transaction. Counting signatures cannot substitute for verifying what those signatures authorise.
A transaction trail needs interpretation
Kayode distinguishes visible transaction records from demonstrable connections to a theft. Swaps and bridges leave analysts with additional relationships to establish.
“The investigator, therefore, has to follow the value rather than wait for the original asset to reappear,” Kayode writes.
Elliptic’s August 2025 review gives that argument concrete detail. It describes laundering routes involving multiple rounds of mixing and cross-chain transfers, including movements through less familiar networks and services. It also reports cases in which rejected deposits were refunded to fresh addresses rather than the sending wallet, complicating the expected trail.
Elliptic cites a zeroShadow report estimating that more than $1 billion had been laundered by that point. It suggests professional laundering operations may have handled portions of the proceeds, while retaining uncertainty about which actors controlled the funds at different stages.
That uncertainty matters. A diagram can show a route without, by itself, explaining every participant’s knowledge or intention. For readers assessing an investigation, the useful question is how each connection was established and what evidence supports the conclusion drawn from it.
Tracing and stopping are separate achievements
Chainalysis’s account, updated on 27 February 2025, describes the use of intermediary wallets, asset conversions and cross-chain services following the attack. It also reports helping industry contacts freeze more than $40 million of the stolen funds. That is a dated account of intervention, rather than a current recovery total.
A later example came from Greece. In July 2025, Chainalysis reported that the Hellenic Anti-Money Laundering Authority had traced a portion of the Bybit proceeds and issued a freezing order. According to the company, analysts connected assets in a suspect user’s wallet with the primary wallets involved in the theft. The case was then referred to the prosecuting authority.
These reports describe a sequence with several distinct outcomes: finding relevant transactions, developing evidence, obtaining cooperation or legal authority, and restricting access to assets. A successful step in that sequence does not automatically complete the others.
There is another constraint on intervention. Kayode cautions against equating exposure to stolen funds with responsibility for the theft. Legitimate services and unsuspecting recipients can sit along a transaction path. His warning is that investigators must establish attribution carefully before a connection becomes grounds for action.
What a useful recovery claim should explain
Read together, these accounts suggest a more demanding way to assess crypto recovery claims. A report should make clear whether it describes assets being tracked, frozen, seized or returned. It should identify the date of its figures and explain where the evidence ends and an assessment begins.
For an exchange or protocol, the same distinction belongs in incident planning. A team needs to know who can validate suspicious activity, who can contact relevant services and who can pursue the authority required to intervene. A monitoring alert is the beginning of that response.
Kayode’s analysis is valuable because it keeps attention on the work after the headline theft. The public ledger provides evidence; investigators, service providers and authorities still have to turn it into a defensible case and an effective response.
Source acknowledgement
This commentary draws on Popoola Kayode’s article for Hacken, with supporting reporting from the investigations listed below.
Popoola Kayode (PopeBlack), Inside the Hunt for the Bybit Billion: What Happens After Crypto Theft? https://hacken.io/discover/tracing-bybit-billion/
Hacken, Bybit Hack Investigation: The Biggest Crypto Heist in History. https://hacken.io/insights/bybit-hack/
Elliptic, Bybit exploit six months on, 21 August 2025. https://www.elliptic.co/insights/bybit-exploit-six-months-on/
Chainalysis, Bybit Hack: Leveraging Transparency for Collaboration in the Wake of Record-Breaking Theft, updated 27 February 2025. https://www.chainalysis.com/blog/bybit-exchange-hack-february-2025-crypto-security-dprk/
Chainalysis, First-Ever Crypto Seizure in Greece, 9 July 2025. https://www.chainalysis.com/blog/greece-first-ever-crypto-seizure-bybit-hack-2025/