Bybit theft and later laundering allegations
The FBI's attribution of the Bybit theft, and the FinCEN and Justice Department actions on Huione Group, are official. The claim that one broker network laundered those funds is an allegation from an independent investigator. No public charge in these sources names that network.
February 21, 2025 theft; FinCEN actions in 2025; investigator account published October 5, 2026 · FBI: about $1.5 billion taken from Bybit. The $1 billion-plus laundering claim is the investigator's allegation.
The FBI said North Korea was responsible for the theft of about $1.5 billion in virtual assets from Bybit on or about February 21, 2025, activity it calls TraderTraitor, and that the assets were being converted to bitcoin and dispersed across thousands of addresses. Bybit confirmed that one ether cold wallet was compromised. FinCEN later found Cambodia-based Huione Group to be a primary money-laundering concern and cut it off from the U.S. financial system under a Section 311 special measure, which is not an OFAC sanctions listing. Treasury said Huione laundered at least $4 billion in illicit proceeds from August 2021 to January 2025, including at least $37 million from North Korean cyber heists. In June 2026 the Justice Department said it seized backend infrastructure used by Huione Group money-laundering services and alleged that Huione Guarantee ran Telegram markets. Separately, investigator ZachXBT published an account of infiltrating a broker he said had laundered more than $1 billion connected to Lazarus Group. crypto.news reported that FBI, Treasury, and Tether releases it reviewed did not independently confirm that figure or name the alias in the thread. SHERLOC is not affiliated with that investigator, and this page does not mean he endorses SHERLOC.