FBI Links North Korea to $1.5B Bybit Hack, Flags Crypto Addresses

The FBI has officially confirmed North Korea's involvement in a massive cryptocurrency exchange hack, publicly attributing the theft to the Hermit Kingdom's state-sponsored hackers and calling on the decentralized finance community to take immediate defensive action. The bureau issued a formal request asking DeFi platforms, exchanges, and blockchain service providers to block specific Bitcoin, Ethereum, and Solana wallet addresses believed to be holding or moving the stolen funds.

North Korean cyber operatives, widely tracked under the umbrella designation Lazarus Group, have become synonymous with large-scale digital asset theft over the past several years. The FBI's public attribution and address-blocking request represents one of the more aggressive postures U.S. law enforcement has taken in attempting to freeze the movement of crypto proceeds tied to a nation-state actor.

Read more Wall Street Faces Jobs Data, Midterms, and Big Tech Earnings →

By flagging the specific wallet addresses, federal investigators are effectively asking the broader crypto ecosystem — including decentralized protocols that typically operate without gatekeepers — to act as a de facto enforcement layer. The appeal underscores a growing tension in the industry between censorship-resistance principles and compliance with national security imperatives.

The move also signals that U.S. authorities are increasingly relying on community cooperation rather than purely legal mechanisms to contain illicit crypto flows, particularly when funds move quickly across blockchains and jurisdictions. Whether DeFi protocols, many of which are governed by autonomous smart contracts, can meaningfully respond to such requests remains an open and consequential question for the industry.

Continue reading at CoinDesk.