VII. How Much Can This Strategy Actually Recover?
RICO, John Doe actions, emergency injunctions and sanctions coordination together build an asset recovery network, but a complete legal pathway does not mean the stolen assets have already entered a recoverable state.
As of the time Bybit announced the litigation, it disclosed that approximately USD 48.4 million of stolen assets had been recovered, and a further approximately USD 30.5 million had been frozen at more than 28 exchanges and custodians. Together the two amount to approximately USD 78.9 million, approximately 5.3% of the initial loss of USD 1.5 billion. If a further distinction is drawn between "already recovered" and "temporarily frozen," the actual recovery ratio would be even lower.
These figures reveal four stages in digital asset recovery that are often conflated: visible on-chain, controllable in reality, provable in law, and actually returned in reality.
A break at any one of these links may prevent a clearly visible on-chain asset from truly returning to Bybit's hands.
The first threshold: how much of the traceable assets can enter control nodes
As discussed in the middle part, on-chain visibility and real-world controllability are two different things. For recovery rates, what matters is not how many addresses analytics firms can label, but how many of those assets will enter intervenable nodes such as trading platforms, custodians, stablecoin systems or fiat off-ramps. Assets still sitting in the attacker's non-custodial wallets may lack a realistic path for enforcement of a freeze, even if the addresses and balances are fully transparent.
Lazarus lengthens the path and disperses balances through splitting, cross-chain transfers, mixing and peer-to-peer transactions; the practical effect is precisely to compress the time window for these assets to enter controllable nodes and to continuously raise the cost of pursuing any single claim.
When the cost of investigation, litigation and cross-border enforcement exceeds the expected recovery amount of a given asset, continued pursuit may lose commercial justification even if the funds remain "visible."
The second threshold: how much of the controllable assets can pass the proof of ownership
Even if assets enter controllable nodes, Bybit still needs to convert on-chain tracing results into ownership evidence capable of withstanding cross-examination: proving that the original assets were lawfully controlled by it, that the assets were transferred out without authorization, that there is a reliable connection between the property currently claimed and the stolen assets, and that the scope of the freeze matches the traceable assets.
Each time an asset undergoes an exchange, cross-chain transfer, liquidity pool transaction or platform aggregation, the tracing methodology and the scope of restitution gain another layer of dispute.
The third threshold: how much of the already frozen assets can be returned
A freeze only preserves assets temporarily and does not determine ultimate ownership. Bybit still needs to complete lawful service, prove the source of the assets, obtain a final judgment or restitution order, and address objections from account holders and other interested parties.
If the assets are subject to U.S. sanctions rules, their return may also require satisfying OFAC licensing requirements; if the assets are located on offshore platforms, a U.S. court order may also need to be given effect through local judicial assistance, recognition proceedings, or new preservation measures.
Therefore, the approximately USD 30.5 million in frozen assets cannot be directly regarded as funds already recovered. They have merely entered a state in which there is an opportunity for return, and the final amount and timing still depend on ownership, sanctions, and cross-border enforcement proceedings.
Commingling of assets and third-party claims further limit the scope of recovery
After being transferred multiple times, stolen assets may end up in the hands of unaware third parties or may become commingled with other users' lawful assets. Once a third-party objection arises, or the assets at issue cannot be clearly distinguished from other property, the scope of assets that Bybit can continue to freeze and seek to recover may shrink accordingly.
In this case, Joseph F. Corrigan, an Australian citizen residing in Southeast Asia, filed an objection with the court on his own initiative, claiming that he is the lawful owner of approximately USD 39,000 in crypto assets in a certain wallet on the Nexo platform and opposing the court's inclusion of that wallet within the scope of the preliminary injunction. Although Bybit disagreed with Corrigan's account of the facts, given that his identity had been clarified, the amount involved was relatively limited, and it could still seek to assert its rights against him in the future by adding him as a named defendant, Bybit agreed to temporarily exclude that wallet from the preliminary injunction. Accordingly, the court did not issue a preliminary injunction against that wallet, but it has also not yet made a final determination that the assets in question belong to Corrigan.
This episode shows that the amount of associated assets displayed on-chain cannot be directly equated with the amount ultimately recoverable. Once a third party raises an independent claim with some basis, Bybit may need to temporarily forgo emergency freezing of the relevant assets and instead prove in subsequent litigation that it holds superior rights.
Commingling of assets can also limit the scope of recovery. For example, after stolen ETH enters a trading platform's omnibus wallet and is mixed with other users' assets, it is difficult for Bybit to demand a freeze of the entire omnibus wallet merely on the basis that some of the funds are connected to this attack; instead, it needs to further identify the accounts involved and prove that the scope of its claim corresponds to assets that can be continuously traced or reasonably distinguished.
If every wallet that indirectly came into contact with the stolen assets were permanently regarded as a "tainted address," the scope of freezing would continuously expand along the transaction chain, affecting a large number of users unrelated to the attack; conversely, if funds completely lost recoverability after a single transfer or commingling, attackers could easily cut off recovery. Therefore, different jurisdictions need to determine, based on their rules on good-faith acquisition, asset tracing, and treatment of commingled property, how far down the chain Bybit may continue to pursue recovery, how much may be frozen, and how much may be returned.
It follows that the amount Bybit can ultimately recover depends not only on how many assets are traced and frozen, but also on how many of those are not subject to third-party rights challenges and can be reasonably identified from commingled property. The "on-chain associated amount—temporarily frozen amount—ultimately returned amount" is very likely to decrease at each stage.
Why is litigation still worthwhile when a high-value judgment is far removed from actual recovery
As explained in the previous article, civil RICO may give rise to treble damages, but there remains a considerable distance between the theoretical claim scale of approximately USD 4.5 billion and actual recovery.
It is almost impossible for North Korea to voluntarily satisfy a U.S. judgment; even if Bybit overcomes sovereign immunity and prevails, the enforcement stage would still require locating specific property attributable to the relevant defendants, within the enforceable scope, and not subject to enforcement immunity or other rights-based restrictions. Assets blocked by OFAC would not automatically be converted into property available to satisfy Bybit's claim.
Therefore, what truly determines recovery is not the figure stated in the judgment, but how many of the assets involved can enter identifiable, controllable, provable and enforceable real-world nodes.
Nevertheless, this litigation still has practical value.
First, the loss base of USD 1.5 billion is sufficiently large. Even if the ultimate recovery ratio is not high, the absolute amount may cover a considerable portion of the investigation and cross-border litigation costs.
Second, digital asset recovery is not a one-off action. Some funds may lie dormant on-chain for years and then enter trading platforms or fiat off-ramps after outside attention declines. Continuous tracing and preservation of legal rights can provide a basis for control opportunities that arise in the future.
Third, litigation can obtain materials that are difficult for private investigations to obtain. Through court subpoenas and cross-border judicial assistance, Bybit may obtain trading platform KYC, login records, account linkages and banking information. Such materials not only assist in recovering the current assets, but may also identify a broader money-laundering and facilitation network.
In addition, litigation can increase the attackers' monetization costs. Even if all funds cannot be recovered immediately, continued address tagging, promotion of account investigations and pursuit of the liability of facilitators will also compress the space for stolen assets to enter the compliant financial system.
Finally, Bybit also needs to restore market trust. For a trading platform whose core business is safeguarding user assets, its handling capacity after an attack is itself part of its commercial reputation. Continuous tracing, industry collaboration and federal litigation are the message Bybit conveys to users, regulators and partners: the platform will not simply write off the loss, but will continue to pursue recovery through technical and legal means.
Therefore, evaluating whether this litigation is successful cannot depend solely on whether Bybit can recover the full USD 1.5 billion. More reasonable criteria also include: how many assets have actually been recovered and frozen, how many anonymous controllers have been identified, whether key platform records have been obtained, whether new money-laundering nodes have been discovered, whether other jurisdictions have been prompted to take parallel measures, and whether a reusable digital asset recovery path has been established.
From this perspective, the most important outcome of this case may not be a huge default judgment against North Korea, but whether Bybit can gradually transform some assets that originally had only on-chain coordinates and no real-world identity into property that can be actually controlled, supported by evidence, safeguarded by judicial measures, and ultimately returned to Bybit.
For other Web3 enterprises, the most noteworthy aspect of this case is likewise not only how much money Bybit can ultimately recover, but whether, when an attack actually occurs, the enterprise already possesses the capacity to rapidly transform on-chain data into evidence, freezing measures and cross-border recovery actions.
VIII. What lessons does the Bybit case offer to Web3 enterprises?
The Bybit case is markedly exceptional: a USD 1.5 billion loss, an attack attributed by the U.S. government to a state-sponsored cyber actor of the Democratic People's Republic of Korea, U.S. federal litigation, RICO claims, and asset tracing across multiple blockchains and jurisdictions are not scenarios every Web3 enterprise will encounter.
However, the risk-handling logic revealed by this case has general significance: enterprises should, before an attack occurs, establish a mechanism capable of swiftly converting on-chain anomalies into evidence, freeze measures and cross-border recovery actions.
Once funds leave the enterprise's wallet, the incident ceases to be merely a technical security issue and simultaneously involves asset ownership, evidence preservation, platform cooperation, sanctions screening, criminal reporting and cross-border litigation. If the technical, legal and compliance teams still act sequentially at their own paces, the enterprise may well miss the most important asset-preservation window before its internal processes are complete.
Upgrading from a technical response to a joint response
A Web3 enterprise's first reaction after an attack is typically to suspend withdrawals, remediate vulnerabilities, reconcile losses and issue a public announcement. These measures can prevent further expansion of the loss, but they cannot resolve how stolen assets are to be recovered.
A complete incident response should simultaneously activate multiple workstreams: the technical team confirms the attack path and preserves system logs; the wallet and finance teams reconcile assets, permissions and accounting impact; on-chain analysts trace and tag the funds; lawyers assess ownership, evidence and freeze pathways; the compliance team conducts sanctions and anti-money laundering assessments; and management is responsible for deciding major matters such as suspending services, reporting to authorities, external disclosure and cross-border recovery.
These workstreams cannot simply be arranged in sequence. For example, the technical team may overwrite key logs while remediating the system; the public relations team, if it discloses the addresses involved and tracing paths too early, may alert the attackers to move the assets; and the business team, if it closes accounts before preserving materials, may also affect subsequent investigation. The significance of a joint response is to enable all teams to advance in sync around the same factual record and action priorities.
Enterprises should also establish emergency authorization mechanisms in advance. Who has authority to suspend wallet operations, who may send freeze requests to trading platforms, who is responsible for contacting law enforcement and external counsel, and what loss amount triggers management or board involvement should not be discussed level by level only after an attack occurs.
External communications should also be incorporated into the joint response. Announcements need to distinguish confirmed facts from judgments still under investigation, government or third-party attribution from final court determinations, and assets already recovered from assets merely temporarily frozen. Disclosing too little may intensify market suspicion, while disclosing too much may expose investigation paths and freeze plans.
Enterprises insured under cyber security insurance, crime insurance or digital asset insurance should also notify insurers promptly and clarify in advance evidence requirements, allocation of litigation costs, subrogation and mechanisms for distributing recovered funds. Otherwise, delays or improper statements during handling may further affect insurance claims.
Seizing the asset recovery window after an attack
The most critical time for digital asset recovery is often not when the court ultimately renders its judgment, but the first few hours and days after an attack occurs.
The earlier tracing is initiated, the easier it is for the enterprise to establish a complete initial fund flow, identify the point in time when assets enter trading platforms or other centralized nodes, and submit freeze requests before the funds have been repeatedly split, cross-chain transferred and commingled.
Therefore, enterprises should not wait until after an incident occurs to hastily study a series of basic questions: which on-chain analysis firm to contact, which entity within the group should report the case and assert rights, who is responsible for liaising with trading platforms and custodians, in which jurisdiction emergency measures can be sought, and whether users, regulators and insurers need to be notified.
These resources and decision-making pathways should be incorporated into the incident response plan in advance. At a minimum, a contact network of key trading platforms, custodians, stablecoin issuers, on-chain analysis firms, law enforcement agencies and external counsel should be prepared in advance, together with freeze request templates that can be quickly completed and sent.
An effective emergency freeze request typically needs to state the victim entity, the course of events, the original transaction hash, the addresses involved, the key fund paths, and the specific transaction information concerning the entry of assets into the relevant platform. The enterprise should also simultaneously request that the platform preserve KYC, login IP, device, transaction and withdrawal records, and confirm whether the platform requires a police letter, court order or other materials to extend the freeze period.
The primary purpose of the first notice is to make the platform aware of the risk, temporarily preserve the status quo and preserve evidence that may be lost. Only after securing this window can subsequent reporting, litigation and restitution proceedings have a realistic subject.
Establishing an on-chain evidence system that can be presented in court
Enterprises cannot wait until litigation is initiated to convert on-chain fund flows into evidence. Original transaction data, time of acquisition, block height, transaction hash, personnel who extracted the data, analysis tools and review process should all be fully recorded from the outset of the incident. At the same time, objective facts, professional inferences and risk ratings should be clearly distinguished. For example, "100 ETH transferred from address A to address B" is an on-chain fact; "address A and address C may be controlled by the same entity" is an analytical conclusion; and "the entity belongs to the Lazarus Group" requires government attribution or off-chain evidence in support.
When engaging an on-chain analysis firm, the enterprise should also confirm whether the firm can preserve the underlying data, explain its clustering methodology and margin of error, and, where necessary, issue an expert report or cooperate with court cross-examination.
Enterprises should also clarify the legal ownership of assets in advance. In large Web3 groups, brand operations, website services, wallet management, customer contracts and accounting records may belong to different companies. After an attack occurs, courts and trading platforms will further inquire: who controls the compromised wallet, whether the assets belong to the company or to users, which entity bears the redemption obligation, who has suffered loss in the legal sense, and who has the right to report the case, apply for a freeze and initiate litigation.
If the enterprise cannot clearly answer these questions in its day-to-day operations, even if the on-chain fund paths are very clear, recovery may be delayed due to unclear plaintiff identity, asset ownership and attribution of loss.
An on-chain evidence system must ultimately connect two ends: on one end, transaction hashes, wallet addresses and fund paths; on the other end, corporate entities, customer contracts, accounting records and asset rights.
Only when the two correspond can the 'visible money' on-chain potentially become property that a court can deal with.
Map asset control in advance
Enterprises should record in advance who holds the private keys, account permissions, smart contract management rights or fiat off-ramps for different assets, and map asset control accordingly.
This map should at a minimum cover the issuer, custody method, wallet permissions, redemption paths, contract emergency functions, major trading venues, relevant jurisdictions and emergency contacts, and should promptly answer after an attack occurs: at which node the assets are located, who can technically prevent their movement, and which court or regulator can influence that entity.
For DeFi projects, it should also specifically examine whether the contract can be upgraded, whether there are administrator keys, pause functions or governance multisigs, and who controls infrastructure such as the front end and oracles. An asset control map does not require all protocols to have freeze functions; rather, it helps enterprises accurately locate real-world control points.
Establish mechanisms for tiered freezing, sanctions response and cross-border recovery
Digital assets may pass through platforms in multiple countries within minutes. A single court, a single law enforcement agency or a single legal team can hardly complete all recovery work. Enterprises need to tier recovery targets according to the node where the funds are located, the degree of controllability and the expected recovery value.
The first tier consists of assets of relatively large amounts whose fund paths are clear and which have already entered compliant trading platforms or custodial institutions. For such assets, freeze and evidence preservation requests should be sent as a priority, and a prompt assessment should be made as to whether to report to the authorities, apply for emergency injunctions or take local judicial measures.
The second tier consists of assets that remain in non-custodial wallets, cannot be controlled for the time being but are highly traceable. Enterprises can continuously monitor the addresses and immediately escalate handling when the assets enter trading platforms, the stablecoin system or fiat off-ramps.
The third tier consists of assets of relatively small amounts that have been severely commingled or have entered non-cooperative jurisdictions. Such assets can still be kept in tracking records, but a judgment should be made, in light of investigation costs, litigation expenses and the probability of enforcement, as to whether they are worth separate legal action.
Sanctions screening should also adopt risk tiering, rather than merely checking whether a deposit address appears directly on the OFAC list. Where an enterprise or the relevant transaction is subject to U.S. sanctions rules, if assets directly hit a wallet address on the sanctions list, or there are sufficient grounds to show that they are owned or controlled by a sanctioned entity, blocking and reporting measures should be taken in accordance with the applicable rules; for transactions with a short fund path to high-risk addresses or other close associations, processing may be suspended and investigation enhanced; for general historical contact that is more remote and lacks other risk indicators, permanent freezing solely on the basis of on-chain association is inappropriate.
As for cross-border recovery, enterprises should, with a focus on commonly used trading platforms, custodial institutions, stablecoin issuers and fiat off-ramps, identify key jurisdictions in advance and understand whether the local law recognizes the property attributes of digital assets, whether it permits actions against anonymous defendants, whether no-notice freezing measures can be applied for, whether platforms can be required to disclose KYC information, and how foreign court orders are recognized and enforced.
Of course, none of this means that every attack requires litigation on a global scale.
A reasonable recovery objective is not to recover every token at any cost, but rather, within a limited budget and timeframe, to prioritize resources toward assets with a high likelihood of being brought under control, larger amounts, and relatively clear legal pathways.
Ultimately, enterprises need to develop a digital asset recovery playbook that can be activated directly. It should cover at a minimum an inventory of assets, wallets and permissions; internal incident classification and emergency authorization mechanisms; standards for preserving on-chain data and system logs; a network of contacts at external institutions; templates for freeze requests and supporting evidence; rules for classifying sanctions and anti-money-laundering risks; emergency measures in key jurisdictions; and communication mechanisms for users, regulators, insurers and the media.
What Web3 enterprises should remember most from the Bybit case is not the RICO treble damages, nor whether a U.S. court can ultimately sit in judgment over North Korea, but rather a complete legal framework for asset recovery—only by designing technical tracing, evidence preservation, asset preservation, sanctions compliance and cross-border enforcement as a single system can enterprises avoid merely watching funds move on-chain, and instead regain opportunities to take action each time assets enter a centralized platform, expose real-world identities, or approach fiat off-ramps.
