The most important takeaway from the Bybit case for Web3 companies is not the triple compensation under RICO, nor whether a U.S. court can ultimately judge North Korea, but rather a complete legal framework for asset recovery.

Written by: Zhang Qianwen

Seven, how much can this strategy actually recover?

RICO, John Doe, emergency injunctions, and sanctions work together to build a network for asset recovery, but a complete legal path does not equate to stolen assets being in a recoverable state.

As of Bybit's announcement of the lawsuit, it disclosed that approximately $48.4 million of stolen assets had been recovered, with another approximately $30.5 million frozen across more than 28 exchanges and custodians. This totals approximately $78.9 million, accounting for 5.3% of the initial loss of $1.5 billion. If further distinctions are made between "already recovered" and "temporarily frozen," the actual recovery ratio would be even lower.

This set of numbers reveals the four stages often confused in digital asset recovery: visible on-chain, controllable in reality, legally provable, and completed restitution in reality. Any interruption in one of these links may prevent a clearly visible on-chain asset from being genuinely returned to Bybit.

1. The first threshold: How much of the traceable assets can enter a control node

As discussed in the article, on-chain visibility and real-world control are two different matters. For the recovery rate, the key is not how many addresses the analyst can tag, but how much of that asset will enter intervention nodes like trading platforms, custodians, stablecoin systems, or fiat currency exits. Assets that remain in the attacker's non-custodial wallet may lack a feasible path for executing a freeze, even if the address and balance are completely transparent.

Lazarus extends paths and disperses balances through splitting, cross-chain transactions, mixing, and peer-to-peer trading, effectively compressing the time window for these assets to enter controllable nodes while continually increasing the cost of each recovery attempt.

When the costs of investigation, litigation, and cross-border enforcement exceed the expected recovery amount of an asset, even if the funds remain "visible," continuing to pursue recovery may become commercially unreasonable.

2. The second threshold: How many controllable assets can be proven through ownership verification

Even if assets enter controllable nodes, Bybit still needs to convert on-chain tracking results into verifiable ownership evidence: proving that the original asset is legally under its control, that the asset was transferred without authorization, that there is a reliable connection between the claimed property and the stolen assets, and matching the scope of the freeze with the traceable assets.

With each exchange, cross-chain transaction, liquidity pooling, or platform aggregation the asset undergoes, there is an added layer of dispute regarding the tracking methods and the scope of restitution.

3. The third threshold: How much of the frozen assets can be returned

Freezing is merely a temporary retention of assets and does not determine final ownership. Bybit still needs to complete lawful delivery, prove the source of the assets, obtain a final judgment or restitution order, and handle objections from account holders and other interested parties.

If the assets are subject to U.S. sanction rules, restitution may also require compliance with OFAC licensing requirements; if the assets are located on overseas platforms, U.S. court orders may additionally need to be executed through local judicial assistance, recognition procedures, or new preservation measures.

Therefore, the approximately $30.5 million of frozen assets cannot be directly regarded as recovered funds. It has merely entered a state of "potential restitution," and the final amount and timing still depend on ownership, sanctions, and cross-border enforcement procedures.

4. Asset commingling and third-party claims further limit the scope of recovery

After the stolen assets have changed hands multiple times, they may end up in the hands of unsuspecting third parties or may become commingled with other users' legitimate assets. Once there is a third-party objection, or if it is impossible to clearly distinguish the assets involved from others, the range of assets Bybit can continue to freeze and request restitution for may correspondingly shrink.

In this case, an Australian citizen Joseph F. Corrigan, residing in Southeast Asia, independently filed an objection with the court, claiming he was the legitimate owner of approximately $39,000 worth of cryptocurrency in a wallet belonging to the Nexo platform, and opposed the court including that wallet in the preliminary injunction scope. Although Bybit disagreed with Corrigan's account of the facts, considering his identity was clear, the amount involved was relatively limited, and he could still be added as a named defendant to assert rights later, Bybit agreed to temporarily exclude that wallet from the preliminary injunction. The court thereby did not issue a preliminary injunction for that wallet, but it has not yet finally ruled that the relevant assets belong to Corrigan.

This incident illustrates that the on-chain displayed associated asset amounts cannot be directly equated with the final recoverable amount. Once a third party raises a claim of independent rights with some basis, Bybit may need to temporarily forgo the emergency freeze on the relevant assets and instead pursue proving superior rights through subsequent litigation.

Asset commingling also limits the scope of recovery. For example, if stolen ETH enters an aggregation wallet on a trading platform and mixes with other users' assets, Bybit may find it challenging to request a freeze of the entire aggregation wallet solely based on a portion of the funds being related to the attack, requiring further identification of the involved accounts and proving that its claims correspond with continuously traceable or reasonably distinguishable assets.

If all wallets that have indirectly come into contact with stolen assets are permanently regarded as "contaminated addresses," the scope of freezing will continually expand along the transaction chain, affecting a large number of users unrelated to the attack; conversely, if the funds lose recoverability after a single transfer or commingling, the attackers can easily sever recovery efforts. Therefore, different jurisdictions need to determine how far Bybit can continue pursuing recovery, how much to freeze, and how much to return based on their rules regarding good faith acquisition, asset tracking, and commingling treatment.

Thus, it can be seen that the amount Bybit can ultimately recover depends not only on how many assets are tracked and frozen but also on how many of those are not challenged by third-party rights and can be reasonably identified from commingled property. "On-chain associated amounts - temporarily frozen amounts - final returned amounts" are likely to decrease step by step.

5. High judgments are far from actual recovery, yet why it is still worth suing

The previous article has explained that civil RICO could yield threefold damages, but there remains a significant gap between the theoretical request of approximately $4.5 billion and the actual recovery amount.

North Korea is almost certainly not going to voluntarily comply with U.S. judgments; even if Bybit overcomes sovereign immunity and wins, the enforcement stage will still need to locate specific properties belonging to the relevant defendants that are within enforceable reach and not subject to execution exemptions or other rights restrictions. Assets blocked by OFAC will also not automatically convert into Bybit's recovery property.

Therefore, what truly determines the recovery is not the numbers on the judgment but how many involved assets can enter identifiable, controllable, provable, and executable real-world nodes.

Nonetheless, this litigation still holds practical value.

First, the loss baseline of $1.5 billion is large enough. Even if the final recovery rate is low, the absolute amount may cover a significant portion of the investigation and cross-border litigation costs.

Second, digital asset recovery is not a one-time action. Some funds may lie dormant on-chain for years, entering trading platforms or fiat currency exits after external attention diminishes. Continuous tracking and retaining legal rights can lay the groundwork for future control opportunities.

Third, litigation can obtain information that private investigations find difficult to acquire. Through court subpoenas and cross-border judicial assistance, Bybit may retrieve KYC, login records, account associations, and banking information from trading platforms. This information not only aids in recovering current assets but may also identify a broader money laundering and aiding network.

Additionally, litigation can raise the cash-out costs for attackers. Even if all funds cannot be immediately recovered, the continued tagging of addresses, prompting account investigations, and holding accomplices accountable will compress the space for stolen assets to enter compliant financial systems.

Finally, Bybit needs to restore market trust. For trading platforms that center around custodial user assets, the ability to manage post-attack situations is part of commercial credibility. Ongoing tracking, industry collaboration, and federal litigation send a message to users, regulators, and partners: the platform will not simply write off losses but will continue to pursue recovery through technological and legal means.

Thus, evaluating the success of this litigation should not solely focus on whether Bybit can recover all $1.5 billion. A more reasonable standard also includes: how many assets were actually recovered and frozen, how many anonymous controllers were identified, whether key platform records were obtained, whether new money laundering nodes were discovered, whether it prompted other jurisdictions to take parallel actions, and whether a reusable digital asset recovery pathway was established.

From this perspective, the most important outcome of this case may not be a hefty default judgment against North Korea, but whether Bybit can gradually convert some assets that previously only had on-chain coordinates and no real-world identity into property that can be practically controlled, supported by evidence, safeguarded by judicial measures, and ultimately returned to Bybit.

For other Web3 companies, the most noteworthy aspect of this case is not just how much Bybit can eventually retrieve, but whether, when an attack actually occurs, the company already possesses the ability to quickly convert on-chain data into evidence, freeze measures, and cross-border recovery actions.

Eight, what insights does the Bybit case bring to Web3 companies?

The Bybit case has obvious particularity: a $1.5 billion loss, attacks attributed by the U.S. government to North Korean state-sponsored cyber actors, U.S. federal lawsuits, RICO claims, and asset tracking spanning multiple blockchains and jurisdictions are not scenarios that every Web3 company will encounter.

However, the risk management logic unveiled by this case carries universal significance: companies should establish mechanisms prior to an attack that can rapidly convert on-chain anomalies into evidence, freeze measures, and cross-border recovery actions.

Once funds leave the company wallet, the incident is no longer merely a technical security issue, but also involves asset ownership, evidence preservation, platform collaboration, sanction screening, criminal reporting, and cross-border litigation. If technical, legal, and compliance teams proceed in their own rhythms, the company may miss the most critical asset preservation window before internal processes are complete.

1. Upgrade from technical response to collaborative response

The first reaction of Web3 companies after an attack is usually to pause withdrawals, fix vulnerabilities, verify losses, and issue announcements. While these measures can prevent losses from expanding, they do not solve the issue of how to recover already stolen assets.

A complete incident response should simultaneously initiate multiple workstreams: the tech team confirms the attack path and preserves system logs; the wallet and finance teams verify assets, permissions, and financial impacts; on-chain analysts track and tag funds; lawyers assess ownership, evidence, and freeze paths; the compliance team performs sanction and anti-money laundering evaluations; and management is responsible for deciding on significant matters such as pausing services, reporting incidents, external disclosures, and pursuing cross-border recovery.

These tasks should not simply be sequenced. For instance, the technical team might overwrite essential logs while repairing the system; if the publicity team prematurely announces involved addresses and tracking paths, it may alert attackers to move assets; if the business team closes accounts before preserving records, it could affect subsequent investigations. The significance of a collaborative response is to allow all teams to proceed in synchronization around a unified fact template and action priorities.

The company should also pre-establish emergency authorization mechanisms. Who has the right to suspend wallet operations, who can send freeze requests to trading platforms, who is responsible for contacting law enforcement and external attorneys, and at what loss level does management or the board need to intervene, all should not be discussed in layers after an attack occurs.

External communication should also be included in the collaborative response. Announcements need to distinguish between confirmed facts and pending investigations, government or third-party attributions and court final determinations, already recovered assets and those only temporarily frozen. Insufficient disclosure may exacerbate market suspicion, while excessive disclosure might expose investigation paths and freeze plans.

For companies insured against cyber risks, crime, or digital asset insurance, they should promptly notify insurers and clarify requirements for evidence, litigation expense liability, subrogation, and recovery fund distribution mechanisms in advance. Otherwise, delays or inappropriate representations during the handling process may further affect insurance claims.

2. Seize the asset recovery window after an attack occurs

The most critical time for digital asset recovery is often not when the court finally renders a judgment, but in the initial hours and days following an attack. The sooner tracking begins, the easier it is for companies to establish a complete initial capital flow, identify when assets enter trading platforms or other centralized nodes, and submit freeze requests before funds are repeatedly split, cross-chained, and commingled.

Therefore, companies should not only research a series of foundational questions after an incident occurs: which on-chain analysis firm to contact, which entity within the group to report to and assert rights, who is responsible for liaising with trading platforms and custodians, in which jurisdiction emergency measures can be requested, and whether to notify users, regulators, and insurers.

These resources and decision pathways should be pre-written into the incident response plan. At a minimum, advance preparation should encompass contact networks for key trading platforms, custodians, stablecoin issuers, on-chain analysis firms, law enforcement, and external lawyers, as well as establish templates for freeze requests that can be quickly filled out and sent.

An effective emergency freeze request typically needs to specify the victim entity, event chronology, original transaction hash, involved addresses, key funding paths, and specific transaction details of assets entering relevant platforms. Companies should also require platforms to preserve KYC, login IPs, devices, transaction and withdrawal records, and confirm whether the platform needs police letters, court orders, or other documents to extend the freeze duration.

The primary goal of the first notification is to make the platform aware of the risk, temporarily retain the status quo, and preserve potentially lost evidence. Only by seizing this window will subsequent reports, lawsuits, and restitution procedures have actual subjects.

3. Establish an on-chain evidence system that can enter the courtroom

Companies cannot wait until litigation begins to convert on-chain funding flows into evidence. Original transaction data, acquisition timings, block heights, transaction hashes, withdrawal personnel, analytical tools, and review processes should all be comprehensively recorded from the onset of the event. It should also clearly differentiate between objective facts, professional inferences, and risk ratings. For example, "100 ETH transferred from address A to address B" is an on-chain fact; "address A and address C may be controlled by the same entity" is an analytical conclusion; while "this entity belongs to the Lazarus Group" requires government attribution or off-chain evidence to support it.

When hiring on-chain analysis firms, companies should also confirm their ability to preserve underlying data, explain clustering methodologies, and error ranges, and provide expert reports or cooperate with courtroom testimonies when necessary.

Companies should also prearrange the legal ownership of assets. In large Web3 groups, brand operations, website services, wallet management, customer contracts, and accounting records may belong to different companies. After an attack occurs, courts and trading platforms will further inquire: who controls the stolen wallet, are the assets company or user-owned, which entity bears the liability to repay, who has experienced a legal loss, and who has the right to report, apply for a freeze, and initiate litigation.

If a company cannot clearly answer these questions in daily operations, even if the on-chain funding path is very clear, it may still delay recovery due to unclear plaintiff entities, asset ownership, and loss attribution.

The on-chain evidence system must ultimately connect both ends: one end being transaction hashes, wallet addresses, and funding paths, and the other end being company entities, customer contracts, accounting records, and asset rights. Only when these correspond will "visible funds" on-chain potentially become property that the court can manage.

4. Pre-draw an asset control map

Companies should proactively record who holds private keys, account permissions, smart contract management rights, or fiat currency exits for different assets, and accordingly draw an asset control map.

This map should at least cover issuers, custody methods, wallet permissions, redemption paths, contract emergency functions, major trading venues, related jurisdictions, and emergency contacts, quickly answering after an attack: at which node are the assets located, who can technically prevent their movement, and which court or regulatory agency can impact that entity.

For DeFi projects, there should also be a specific examination of whether contracts can be upgraded, whether there are administrative keys, pause functions, or governance multisigs, and who controls infrastructures like front-ends and oracles. The asset control map does not require all protocols to set freeze functions but helps companies accurately identify practical control points.

5. Establish a layered freeze, sanction response, and cross-border recovery mechanism

Digital assets may pass through multiple countries in a matter of minutes. A single court, law enforcement agency, or attorney team finds it difficult to complete all recovery work. Companies need to stratify recovery targets based on the nodes where funds are located, the degree of control, and anticipated recovery values.

The first layer consists of assets with significant amounts, clear funding paths, and that have already entered compliant trading platforms or custodians. These assets should be prioritized for freeze and evidence preservation requests and quickly assessed for the need to report incidents, apply for emergency injunctions, or take local judicial measures.

The second layer comprises assets that remain in non-custodial wallets, temporarily uncontrollable yet highly traceable. Companies can continuously monitor addresses and immediately escalate handling when assets enter trading platforms, stablecoin systems, or fiat currency exits.

The third layer consists of smaller amounts that have become seriously commingled or have entered jurisdictions uncooperative with the law. Such assets can still retain tracking records, but it’s necessary to decide whether it's worth taking separate legal action based on investigation costs, litigation expenses, and execution probabilities.

Sanction screening should also adopt a risk-based approach rather than simply checking whether recharge addresses directly appear on OFAC lists. For scenarios where companies or relevant transactions are subject to U.S. sanction rules, if assets directly hit wallet addresses on the sanctions list, or there is sufficient basis indicating they are owned or controlled by sanctioned entities, blocking and reporting measures should be taken in accordance with applicable rules; for transactions with short funding paths or other strong ties to high-risk addresses, processing can be paused while investigations are intensified; for general historical contacts that are distant and lack other risk indicators, permanent freezing should not be based solely on on-chain associations.

Regarding cross-border recovery, companies should identify key jurisdictions in advance for commonly used trading platforms, custodians, stablecoin issuers, and fiat currency exits, and understand whether local laws recognize the property nature of digital assets, if suing anonymous defendants is allowed, if ex parte freezing measures can be applied for, whether platforms can disclose KYC information, and how foreign court orders can be recognized and enforced.

Of course, this does not mean that every attack needs to lead to litigation on a global scale. A reasonable recovery goal is not to recover every token without regard to cost, but to prioritize resources in a limited budget and time towards assets that have higher control possibilities, larger amounts, and relatively clear legal pathways.

Ultimately, companies need to form a direct-actionable digital asset recovery manual. This should at least cover lists of assets, wallets, and permissions, internal incident classification and emergency authorization mechanisms, standards for preserving on-chain data and system logs, external agency contact networks, templates for freeze requests and evidence attachments, rules for sanction and anti-money laundering risk grading, emergency measures for key jurisdictions, and communication mechanisms with users, regulators, insurers, and the media.

The most important lesson from the Bybit case for Web3 companies is not the triple compensation under RICO, nor whether a U.S. court can ultimately adjudicate North Korea, but rather a complete legal framework for asset recovery—only by designing technological tracking, evidence preservation, asset preservation, sanction compliance, and cross-border enforcement as a unified system can companies avoid merely watching funds move on-chain and regain opportunities to take action each time assets enter centralized platforms, expose real identities, or approach fiat currency exits.