The Bybit $1.46 Billion Hack Shows Why Tracing Stolen Crypto Is Only Half the Battle

A public record of a theft should be an investigator’s advantage. In crypto, the difficulty is turning that record into an explanation of who controls the money, where it has gone and whether anyone can stop it moving again.

Popoola Kayode, known professionally as PopeBlack, addresses this in an article, Inside the Hunt for the Bybit Billion: What Happens After Crypto Theft? His focus is tracing value as it changes assets and passes through intermediaries.

The Bybit theft provides a particularly consequential example. Elliptic records that approximately $1.46 billion in ETH and ERC-20 tokens was taken on 21 February 2025. Its six-month review describes repeated transfers between networks and privacy services, with some proceeds eventually converted to USDT on Tron and cashed out through suspected Chinese over-the-counter trading services.

Where the security failed

Understanding the recovery problem starts with understanding what the attack compromised. Hacken’s forensic analysis attributes the breach to malicious JavaScript introduced into resources used by the Safe signing interface. The interface concealed the nature of a transaction that authorised signers approved during what appeared to be a routine wallet transfer.