Bybit’s effort to recover assets from the $1.5 billion February 2025 hack has moved deeper into the U.S. court system, with a federal judge granting expedited discovery and later part of the exchange’s request for a preliminary injunction.

Bybit filed the case on June 18 in the U.S. District Court for the District of Columbia against North Korea, its Reconnaissance General Bureau, the Lazarus Group and 20 unidentified defendants.

The exchange’s latest update, published Aug. 7, says about $48.4 million of stolen assets has been recovered, while more than $30.5 million remains frozen across more than 28 exchanges and custodians. That puts roughly $78.9 million in the recovered or frozen category, although the frozen portion has not yet been returned to Bybit.

BREAKING: 🇺🇸 Bybit wins U.S. court approval to pursue and trace funds tied to the $1.5B North Korea-linked hack, but nearly 90% of the stolen crypto is already beyond tracking. pic.twitter.com/uNIjkONu3L

— EyeWhales (@EyeWhales) August 8, 2026

U.S. court gives Bybit faster access to records

Court records show Judge John D. Bates granted expedited discovery on June 19, one day after Bybit filed its complaint under seal. The measure allows the exchange to seek account identities, balances and transaction histories from platforms with U.S. operations that may hold information tied to the stolen funds. The court also issued a temporary restraining order that day to stop certain traceable assets from being moved.

The restraining order was renewed on July 16. On July 30, Bates granted Bybit’s request for a preliminary injunction in part, preserving identified assets while the case continues. Bybit said the court found that “Bybit has demonstrated a likelihood of success on the merits.” That is an interim legal finding, not a final ruling that all allegations in the complaint have been proved.

Most stolen assets are now harder to trace

Bybit said in its June filing that 90.2% of the stolen assets had become untraceable after moving through mixers, cross-chain bridges and over-the-counter dealers. Only 9.8% remained connected to identifiable wallets at that point, while about 5.3% of the original theft, roughly $75.5 million, had been frozen or recovered.

Those figures do not establish that the remaining assets are permanently unrecoverable. “Untraceable” describes Bybit’s stated ability to follow the transaction trail at the time of filing. The new discovery authority could provide offchain records, including customer identities and account histories, that blockchain analysis alone cannot supply. Meanwhile, Bybit’s newer Aug. 7 figures separate $48.4 million already recovered from more than $30.5 million still frozen.

The decline in traceability has been steep. CEO Ben Zhou said in March 2025 that 88.87% of the stolen funds could still be traced, while 7.59% had gone dark and 3.54% had been frozen. The June 2026 filing shows how much more difficult following the assets became as laundering continued.

FBI attribution and Safe findings support the case

The theft occurred on Feb. 21, 2025. Five days later, the FBI formally attributed the attack to North Korea and said it tracks the activity as “TraderTraitor.” The agency said the attackers converted some stolen assets into Bitcoin and other cryptocurrencies and dispersed them across thousands of addresses on multiple blockchains.

The FBI also urged exchanges, bridges, blockchain analytics firms, DeFi services and other virtual asset providers to block transactions linked to addresses it identified in the laundering operation. Bybit says its civil proceeding remains separate from ongoing U.S. criminal investigations and that it continues sharing blockchain intelligence with the agency.

The attack was also traced to compromised infrastructure connected to Safe Wallet. As previously reported, forensic investigators found that a compromised Safe developer machine enabled the attackers to propose a disguised malicious transaction. Safe later said its review found no vulnerability in its smart contracts or source code and that it rebuilt infrastructure and rotated credentials after the breach.

Bybit launched a bounty program shortly after the hack to encourage investigators and platforms to help identify and freeze stolen funds. The federal lawsuit adds discovery and injunction tools to that earlier recovery strategy, giving the exchange another route to identify intermediaries connected to assets within reach of U.S. legal process.

Bybit must turn asset freezes into recoveries

The complaint seeks return of the stolen assets, about $1.5 billion in compensatory damages, punitive damages and treble damages under the U.S. Racketeer Influenced and Corrupt Organizations Act, according to the unsealed court records. Those requests remain claims for relief. The court has not entered a final judgment awarding those damages against North Korea, the Lazarus Group or the unidentified defendants.

The next stage centers on discovery and enforcement. Bybit can seek records from relevant service providers while the preliminary injunction restricts movement of certain identified assets. Further recovery will depend on whether the exchange can connect wallets to identifiable account holders or intermediaries and reach assets held by entities subject to enforceable court orders.

Bybit also credited international cooperation for earlier progress, citing German authorities’ action against eXch and the German-Swiss disruption of Cryptomixer.io, services the exchange said were used to move illicit proceeds. Those actions are separate from the Washington case but form part of a broader effort to close laundering routes used after the theft.

For now, the U.S. court orders give Bybit a stronger legal route to pursue assets that remain within reach, but they do not guarantee additional recovery. The next material developments will include responses to discovery requests, attempts to identify the John Doe defendants, possible additional asset restraint orders and later rulings on the exchange’s claims. Bybit said it intends to seek further judicial relief as the litigation proceeds.

Bitcoin’s BIP-110-enforcing branch has stalled after mining just two blocks, widening the separation from the non-enforcing chain to 88 blocks. The latest update from a BIP-110 monitoring dashboard shows the mandatory-signaling version of the network making extremely slow progress as it awaits further blocks to complete the current difficulty-adjustment window.

According to the BIP-110 monitor (updated at 10:19 am UTC), the enforcing branch was last seen at block 961,633 after a long gap since its previous block. In the meantime, the non-enforcing chain advanced to block 961,721, underscoring how thin the enforcement-side hashpower currently is.

Key takeaways

• The enforcing branch produced only two blocks before stalling, while the non-enforcing chain continued forward, increasing the block-gap to 88.
• The divergence began after BIP-110 entered mandatory signaling at block 961,632, during which only 2.53% of blocks in the preceding window signaled support.
• Mandatory signaling is scheduled to continue through block 963,647, but difficulty adjustment won’t fully help until the enforcing side mines through the remainder of the 2,016-block adjustment period.
• Mining activity on the enforcing branch’s early blocks was attributed, via Ocean records, to a pseudonymous group using Ocean’s DATUM mining protocol.

Where the chains split

The split traces back to the moment BIP-110 moved into mandatory signaling mode. Earlier on Saturday, BIP-110 entered mandatory signaling at block 961,632. During the preceding 2,016-block adjustment window, only 51 blocks—about 2.53%—signaled support.

This matters because, under the BIP-110 rules, enforcing nodes reject blocks that do not signal via version bit 4, while standard Bitcoin nodes continue to accept both signaling and non-signaling blocks. The result is that the enforcing branch can lag if insufficient miners actively produce signaling blocks during the mandatory phase.

Under the proposal documented in the BIPs repository for BIP-110, mandatory signaling continues through block 963,647. Enforcing nodes must mine through the rest of the 2,016-block adjustment period before difficulty can adjust on their branch—an environment where even a temporary shortage of supporting hashpower can create long delays.

Stalled progress and the role of adjustment windows

Even when enforcement rules are live, the network’s practical pace can remain constrained by the mechanics of Bitcoin’s difficulty targeting. The BIP-110-enforcing side can’t benefit from a difficulty change until it has advanced far enough within the current adjustment period.

Ocean’s records cited in the BIP-110 monitor coverage indicate that a pseudonymous mining group—Roughnecks—produced the first two enforcing-branch blocks using Ocean’s Decentralized Alternative Templates for Universal Mining (DATUM) mining protocol. Those two blocks appear to be the basis for the enforcing-side head seen at block 961,633, after which progress slowed materially.

With the non-enforcing chain reaching block 961,721, the distance between the two heads has grown quickly once the enforcing branch stopped producing frequent blocks. For miners and observers, this is a concrete reminder that “mandatory signaling” does not automatically translate into immediate, sustained block production on the enforcing side—especially if the number of miners willing to follow version bit 4 during the mandatory phase is limited.

What BIP-110 requires—and why critics warn

BIP-110’s stated mechanism is straightforward: enforce nodes require blocks to signal through a specified version bit, while ordinary Bitcoin nodes tolerate both signaling and non-signaling blocks. That design is intended to curb unwanted data patterns described in the broader debate around spam and template behavior.

Still, the approach has drawn notable resistance from influential figures in the Bitcoin ecosystem. Cointelegraph previously reported that Strategy executive chairman Michael Saylor supports the general objectives but argued the proposal’s method threatens Bitcoin’s “neutral rules” and consensus integrity. Separately, Blockstream CEO Adam Back has warned that the consensus-level change could damage Bitcoin’s credibility and may make certain unspent transaction outputs unspendable, according to earlier Cointelegraph coverage.

The stalled enforcing branch provides a live illustration of how contentious or under-resourced changes can become when they rely on adoption by a critical mass of miners. If enforcement is accepted by fewer miners than required to keep block production competitive, the chain running enforcement rules can fall behind—even if the rules themselves are technically activated.

What to watch next

For now, readers tracking BIP-110 should focus on whether additional miners begin signaling in larger numbers as the mandatory window continues through block 963,647, and whether the enforcing branch’s block production improves before the next difficulty adjustment opportunity. If the hashpower supporting version bit 4 remains limited, the enforcing chain may continue to lag—turning a theoretical protocol enforcement into a practical question of miner participation.

Galaxy Research Vice President Lucas Tcheyan said on Aug. 7 that Ethereum and Solana are confronting a similar policy question: how much token issuance is needed to pay for network security, and when does that security budget become more costly than useful? The debate is moving through proposal processes on both networks, but neither blockchain has approved an inflation change.

One important update concerns Ethereum’s proposal number. Galaxy initially referred to the Tapered Issuance Burn proposal as EIP-8361. Ethereum’s EIP editors later assigned it EIP-8363 because EIP-8361 had already been allocated elsewhere. The EIP-8363 pull request remained open as of Aug. 9, and an editor requested changes on Aug. 6.

Ethereum proposal would taper rewards as more ETH is staked

EIP-8363 would burn a growing share of consensus layer validator rewards as Ethereum’s staking ratio rises. The burn fraction would reach 100% around a 50% staking ratio, removing new issuance as an incentive for additional staking beyond that level. The authors propose an 18 month transition because applying the full mechanism immediately would sharply reduce validator returns.

Galaxy estimated that, with roughly one third of ETH staked, consensus layer yield would fall from about 2.6% to 1.2% under the full design. MEV and priority fees would remain outside the proposed burn. Those figures describe a modeled outcome, not an approved change to Ethereum’s monetary policy.

The Aug. 6 All Core Developers Consensus agenda listed Tapered Issuance Burn among proposals being considered for Hegotá. The agenda explicitly said the meeting was not a decision to include or schedule those proposals. No network vote or activation date has been set.

Meanwhile, SharpLink CEO Joseph Chalom opposed the issuance change, arguing lower staking returns could make ETH less attractive to institutions and raise financing costs in DeFi. Those outcomes remain forecasts. As crypto.news previously reported, supporters instead argue Ethereum may be paying more issuance than necessary as staked ETH rises.

Solana proposals target emissions and transaction burns

Solana is considering two separate changes. SIMD-0550 would double annual disinflation from 15% to 30% while keeping the terminal inflation floor at 1.5%. The technical proposal was merged into Solana’s improvement document repository on July 23 with Review status, but that does not activate the change.

SGP-0002 asks validators and delegators whether Solana should pursue the faster schedule. Its authors estimate the change would bring the terminal rate forward from about 5.7 years to 2.8 years and produce roughly 18.9 million fewer SOL in emissions over six years. The “18.9 million SOL” reduction is a projection, not a guaranteed change in supply.

SGP-0003 addresses fees. It backs SIMD-0553, which would add an inclusion fee and a resource based fee tied to transaction resource use, with the resource component burned in full. Galaxy cited estimates that daily burns could rise from roughly 650 SOL to between 7,500 and 9,000 SOL under recent network conditions.

However, the burn estimate is already being refined. On Aug. 9, SIMD-0553 author cavemanloverboy said he had been told earlier estimates were “misleading” and published optimistic and pessimistic bounds using the previous month’s traffic. He also noted that contract optimization and other behavioral changes could reduce future burns, meaning the eventual level cannot be treated as fixed.

Solana governance still stands between proposals and activation

Galaxy said SGP-0002 and SGP-0003 each secured support from at least 15% of active stake, enough to advance under Solana’s new onchain governance process. Under the official governance rules, reaching that threshold starts an 11 epoch sequence: seven epochs for discussion, one for a stake snapshot and three for voting.

A proposal passes only if For votes represent at least 66.67% of decisive stake, meaning For plus Against votes. Abstentions are excluded, and there is no separate quorum requirement. Even a successful SGP is a directional mandate rather than automatic code activation; the associated SIMD still needs development and feature gate deployment.

The process follows Solana’s earlier difficulty in changing inflation. SIMD-0228 failed in March 2025 despite 61.39% support because it did not reach the required two thirds approval level. More recently, Solana introduced its SGP framework to separate stake weighted policy signals from technical SIMD review.

What happens next for Ethereum and Solana inflation

Ethereum developers will continue reviewing EIP-8363 and deciding whether it should progress toward Hegotá. The proposal remains an open pull request, and the Aug. 6 developer meeting treated it only as a candidate for further consideration. Any adoption would require more review, agreement on upgrade inclusion and client implementation.

Solana’s path is tied to its governance clock. SGP-0002 and SGP-0003 must complete discussion, stake snapshot and voting stages before either direction is accepted. Technical activation would follow separately. For now, the proposals alter expectations about future ETH and SOL supply rather than either network’s current issuance rules.

Galaxy’s broader view is that both communities are reassessing the price they pay for security as their networks mature. The firm argues lower issuance may improve scarcity at the margin, but demand for blockspace and applications remains the stronger long term driver of token value. With no final decision, any repricing of future supply remains dependent on proposals still under debate.

Brazil’s central bank is introducing a new anti-fraud rule for cryptocurrency transfers, requiring regulated virtual asset service providers (VASPs) to temporarily “hold” certain outbound payments. The measure is designed to slow down potentially fraudulent flows that take advantage of cross-border speed and the complexities of self-custody transfers.

According to a statement from the Banco Central do Brasil (BCB), the rules will apply to funds received above $10,000—either in a single transaction or based on a customer’s total transactions over a day—when those funds are sent to foreign platforms or to customers’ self-custody wallets. The precautionary hold can last up to 24 hours, and providers will also need to hold other transfers that require additional review under their risk-management systems.

Key takeaways

• Brazil’s central bank (BCB) will require up to 24-hour precautionary holds on certain VASP transfers tied to fraud prevention.
• The rule targets transfers involving funds received above $10,000, measured by single transactions or daily aggregates.
• Holds must also cover other transfers flagged for extra scrutiny under a provider’s existing risk policies.
• The requirement takes effect Jan. 1, 2027, with VASPs required to disclose holds to customers and keep detailed records.

24-hour holds for high-value cross-border and self-custody transfers

The BCB says the framework applies when VASPs receive funds over the $10,000 threshold and then transfer them to either overseas providers or wallets held directly by customers. The central bank’s approach is effectively threshold-based: it covers not only one-off large transactions but also cases where multiple smaller moves add up to more than $10,000 in a day for the same customer.

Beyond the headline threshold, the rules also extend to “other transfers requiring further scrutiny” according to each provider’s risk-management policies. That language matters because it gives regulators flexibility to capture additional suspicious patterns even when transfers fall below the $10,000 number, as long as the provider’s compliance framework would normally treat them as higher risk.

When VASPs can release transfers early

A key operational detail is that the hold is not necessarily an automatic full 24-hour delay in every case. The BCB’s statement indicates that a VASP can complete its assessment and release a transfer before the 24 hours expire, as long as it follows parameters set out by the central bank.

Separately, VASPs will be expected to notify customers that a hold has been applied and to document relevant compliance activity. The BCB also requires providers to keep records related to fraud incidents, attempted fraud, and the corrective actions they take. For traders and users, the practical implication is that transfers to foreign platforms or self-custody wallets may become more variable in settlement timing—especially around higher-value or risk-flagged transactions—even if a provider ultimately clears the transfer quickly.

Brazil’s shift reflects a broader anti-scam push

Brazil’s central bank move comes as regulators globally respond to crypto scams that are enabled by fast settlement and the borderless nature of digital assets. The BCB’s approach mirrors a growing trend: slowing down or gating withdrawals and outbound transfers long enough to detect fraud patterns.

Earlier this year, Japan’s Financial Services Agency and National Police Agency asked crypto exchanges to restrict withdrawals in certain circumstances after users deposit fiat currency or buy digital assets. The Japanese authorities outlined expectations that exchanges require customers to pre-register withdrawal addresses, impose a waiting period for newly added addresses, and adopt additional measures such as customer-specific withdrawal limits and stronger monitoring. They also pointed to security practices including phishing-resistant multifactor authentication and checks to ensure the name of a bank remitter matches the account holder of the crypto transaction.

However, the Japan steps are not binding, and exchanges retain flexibility over how they implement restrictions based on their operations and exposure to misuse. Brazil’s plan, by contrast, is framed as an explicit central-bank requirement with a clear effective date and compliance obligations.

What to watch as the rules approach 2027

With the BCB rules scheduled to begin on Jan. 1, 2027, VASPs operating in Brazil will need to ensure their transfer monitoring systems can reliably identify the threshold conditions—particularly the “single transaction or daily total” logic tied to inbound funds above $10,000. They also need workflows for customer notification and for maintaining compliance records on fraud-related events and responses.

For users, the biggest day-to-day impact is likely to be around transfer timing and the need for clarity from providers when outbound moves are paused for review. For investors and market participants, these kinds of rules can affect how quickly capital moves through on-ramps, custody, and exchanges—potentially changing risk pricing, liquidity expectations, and the practical usability of cross-border or self-custody transfers during periods of heightened scam activity.

The next question for Brazil’s crypto market is how strongly providers will apply holds under the broader “risk-management” portion of the framework, and whether central bank guidance will specify further operational parameters that determine when transfers can be released early. Those details will likely shape how disruptive compliance becomes in practice—and how effectively it deters fraud without unduly burdening legitimate users.

Bitcoin’s BIP-110-enforcing branch stalled at block 961,633 on Sunday after producing only two blocks, while the non-enforcing chain advanced to 961,721, widening the gap to 88 blocks. 

According to the BIP-110 monitor, updated at 10:19 am UTC, the branch’s latest block had been mined about 12 hours earlier. Ocean records show that a pseudonymous mining group called Roughnecks produced the branch’s first two blocks using Ocean’s Decentralized Alternative Templates for Universal Mining (DATUM) mining protocol. 

The divergence began after BIP-110 entered mandatory signaling at block 961,632 on Saturday. Only 51 of the preceding 2,016 blocks, or 2.53%, signaled support. During this window, BIP-110 nodes reject blocks that do not signal through version bit 4, while ordinary Bitcoin nodes accept both signaling and non-signaling blocks. 

Under the proposal, mandatory signaling continues through block 963,647. The enforcing branch must mine through the remainder of the 2,016-block adjustment period before its difficulty can adjust, making progress slow without substantially more hashpower.

BIP-110 has faced opposition from prominent Bitcoin advocates. Strategy executive chairman Michael Saylor said he shared the proposal’s objectives but argued that its approach threatened Bitcoin’s neutral rules and consensus. 

Blockstream CEO Adam Back warned that the consensus-level change could damage Bitcoin’s credibility and potentially make certain unspent transaction outputs unspendable. 

Related: Bitcoin nodes running BIP-110 crosses 2% as spam wars heat up

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

Brazil’s central bank has approved new rules that require virtual asset service providers (VASPs) to temporarily freeze certain crypto transfers before sending funds to foreign platforms or self-custody wallets. The precautionary hold is designed to give firms time to review suspected fraud and suspected illicit behavior.

According to a note published by the Banco Central do Brasil (BCB) on Friday, the requirement takes effect on Jan. 1, 2027 and will apply to transfers where the amount received by a customer exceeds $10,000, either as a single transaction or based on the customer’s total activity in a day. In addition to that threshold, VASPs must also place holds on other transfers flagged for enhanced scrutiny under their risk-management systems.

Key takeaways

• Brazil’s BCB will require VASPs to implement precautionary holds of up to 24 hours on certain outbound virtual asset transfers.
• The initial trigger is $10,000 in value received, measured per transaction or aggregated across daily customer activity.
• Holds also cover transfers marked for review under a provider’s existing risk-management policies.
• VASPs must inform customers about holds and maintain records of fraud incidents and remediation steps.
• Japan’s earlier anti-scam measures exist, but they are non-binding—a key difference from Brazil’s approach.

How the 24-hour hold will work

Under the BCB’s framework, VASPs must apply precautionary holds to certain transfers once the underlying conditions are met. The central bank’s statement specifies that the rules cover funds received above $10,000, either in a single transaction or through the accumulation of transactions over the course of a day.

The BCB also requires providers to place holds on additional transfers that need further evaluation under their own risk policies. In other words, the $10,000 threshold is not the only gate: the central bank expects VASPs to treat certain flagged activity more cautiously, even if the threshold is not the only factor.

Providers will be allowed to complete their assessment and release a transfer before the 24-hour window ends, as long as they follow parameters set out by the BCB. That gives firms flexibility in cases where they can quickly clear the transfer after review.

Operational duties for VASPs

The BCB’s note makes clear that the hold mechanism comes with compliance obligations. VASPs must:

• Notify customers when a transfer is subject to a hold.
• Keep records of fraud incidents, attempted fraud, and the corrective actions taken in response.

These requirements matter for users and firms alike because they effectively formalize what providers must do when suspicious cross-border activity is detected. For traders and businesses relying on fast settlement, the policy introduces a potential delay on outbound transfers routed to foreign venues or self-custody addresses when the relevant conditions apply.

Why this is being tightened now

The central bank’s move reflects a broader shift among regulators as they confront scams that leverage the speed and global reach of digital assets. Crypto transfers can settle quickly across borders, which can help legitimate users—but it also creates opportunities for criminals to move funds before counterparties can intervene.

Brazil’s rules are part of a larger international pattern where regulators seek to slow down or add friction at key stages of the transfer process, particularly when money is leaving regulated custody environments for higher-risk destinations such as self-custody wallets.

That context is especially important for investors and service providers: while blockchain activity is transparent, reversing losses is often difficult. Measures like precautionary holds aim to reduce the chance that funds are sent to the wrong addresses in the first place.

Comparisons: Japan’s withdrawal delays and Europe’s scam warnings

Brazil’s action follows similar anti-scam developments elsewhere. In Japan, the Financial Services Agency and the National Police Agency asked crypto exchanges to restrict withdrawals after customers deposit fiat or buy digital assets. As reported earlier by Cointelegraph, Japanese authorities urged exchanges to implement controls such as requiring customers to preregister withdrawal addresses and applying a waiting period before newly added addresses can be used.

Other safeguards discussed in Japan include customer-specific withdrawal limits, stronger monitoring, phishing-resistant multifactor authentication, and checks intended to confirm that a bank remitter’s name matches the crypto account holder.

However, the Japanese measures are not binding. Exchanges can decide how to implement protections based on their own operations and exposure to misuse, which stands in contrast to Brazil’s regulatory timing and threshold-based structure.

In Europe, regulators have also highlighted risks tied to impersonation and fraud. Earlier coverage from Cointelegraph noted warnings about criminals impersonating watchdogs and crypto firms, including instances involving fake websites and the misuse of identity and logos in falsified documents. While those reports focus more on deception surrounding licensed providers, they point to the same underlying issue: scammers adapt quickly to user demand, especially when people are looking for regulated access points.

What to watch next

With Brazil’s hold rules scheduled to begin on Jan. 1, 2027, VASPs will likely adjust transfer flows, customer communications, and fraud-review processes well before the effective date. Users sending large transfers to foreign services or self-custody wallets should watch how providers interpret the $10,000 trigger and what criteria they use to classify additional transfers as “requiring further scrutiny.”