A federal judge has given Bybit the green light to freeze crypto held in wallets suspected of containing funds linked to North Korea’s $1.5 billion hack of the exchange in February 2025.
The injunction gives Bybit legal backing to restrict access to wallets that the exchange believes received or still hold assets connected to the attack. But the case also highlights a tricky problem for crypto exchanges trying to recover stolen funds: sometimes, legitimate users can get caught in the net.
Bybit notified the owners of the anonymous wallets about the freezes by sending them NFTs. Since blockchain wallets do not necessarily come with a name or other identifying information, sending an NFT directly to an address gave the exchange a way to reach people it could not otherwise identify.
The approach soon led to a legal challenge from an Australian man whose account, holding around $39,000 in crypto, was frozen.
The man successfully challenged the freeze, showing how complicated it can be for exchanges to determine whether a wallet is actually controlled by someone involved in a hack or has simply interacted with funds that can be traced back to the stolen assets.
Stolen crypto can create innocent wallet links
The issue stems from the way stolen crypto moves. Once hackers take digital assets, they can send them through a long chain of wallets, swap them for different tokens and move them across multiple blockchain networks. This can make the money harder to trace and, in some cases, create links between stolen funds and wallets belonging to people who had nothing to do with the original crime.
That creates a unique challenge for exchanges. Blockchain transactions are public and can be tracked, but identifying the person behind a wallet address is often much harder. A wallet interacting with stolen funds does not necessarily mean its owner knew where those funds came from.
For Bybit, recovering the assets has been a major priority since the February 2025 attack, which was one of the largest crypto hacks ever recorded. The exchange has been working to track the stolen funds and prevent them from being moved further through the crypto ecosystem.
The court order strengthens Bybit’s ability to stop suspected stolen assets from being transferred while the legal process continues. However, the Australian user’s successful challenge shows that freezing wallets based on transaction links can also create problems for innocent users.
Use of NFTs also peculiar in the case
The use of NFTs to notify wallet holders is another unusual element of the case. Traditional financial institutions generally have customer information that allows them to contact account holders directly. Crypto wallets, by contrast, can be controlled anonymously, leaving exchanges with limited ways to notify their owners.
Sending an NFT effectively turns the blockchain itself into a notification channel.
The case could therefore have broader implications for how crypto exchanges handle stolen funds in the future. As platforms become more aggressive in tracking and freezing assets connected to hacks, they will also have to balance those efforts with the rights of users who may have unknowingly interacted with tainted crypto.
For now, Bybit has secured a court-backed tool to keep suspected hack proceeds from moving. But the $39,000 case is a reminder that following crypto on the blockchain is only half the battle. Figuring out who is actually responsible can be much harder.
