Wallet-Risk Note Example: Reviewing a Deposit Linked to the Bybit Hack
As moderator of AOB’s compliance and forensics threads, the question I see most is: what does a “proof piece” actually look like? Here’s one, end to end. It’s a one-page wallet-risk note, the kind a transaction monitoring or investigations analyst at an exchange might write.
How to read it. The scenario, a customer deposit to an exchange, is invented, and so are its addresses. The background on the Bybit hack comes from the public reports linked at the end. This is a teaching example put together for AOB, not an original investigation and not legal advice.
The case in brief (public facts)
What happened:
On 21 February 2025, attackers drained about 401,000 ETH plus around 113,000 staked-ETH tokens (stETH, cmETH, mETH) from a Bybit multisig cold wallet, worth roughly $1.4–1.5 billion in total. They tricked the wallet’s signers by showing them a tampered Safe{Wallet} interface. Safe’s smart contracts themselves were not compromised (Nansen).
Who:
The FBI attributed the hack to North Korean actors it calls “TraderTraitor,” a label that includes the Lazarus Group (The Block).
Where the money went:
Funds moved from one address into 40+ wallets, then thousands. Staked tokens were swapped for plain ETH on decentralized exchanges such as Uniswap, ParaSwap and KyberSwap. In a 4 March 2025 update, Bybit’s CEO said that of roughly 499,000 ETH-equivalent stolen:
about 417,000 ETH had been converted to Bitcoin, much of it through THORChain, and spread across 6,954 wallets
about 80,000 ETH had passed through eXch
about $42 million had been frozen
The note
Wallet-risk note: incoming ETH deposit
Case: customer account 48213 (invented) · Analyst: [name] · Date: [date]
1. Trigger
Our blockchain monitoring tool flagged a deposit of 12.4 ETH from address 0x7F3…a91 (invented). The funds are three hops from wallets publicly linked to the Bybit hack.
2. What I checked
The trail: on a block explorer, 0x7F3…a91 received the ETH from 0x2C8…4d0 (invented), which received it from a wallet in the hack’s first distribution layer, as named in public reporting.
Timing: each hop happened within 40 minutes of the one before, in late February 2025.
Pattern: amounts were split into round numbers and moved through newly created addresses with no other history.
The customer: account opened 9 days before the deposit; KYC complete; stated source of funds “trading profits”; no previous deposits.
3. What’s confirmed
The on-chain path from the hack-linked wallet to the address that sent our customer’s deposit. Each transaction can be checked on a block explorer.
4. What’s likely, but not confirmed
That the customer controls 0x7F3…a91. The deposit could come from someone else, or the customer may have bought the ETH without knowing its history.
That all 12.4 ETH are hack proceeds. By the third hop, the trail can mix in unrelated funds.
5. Risk assessment: High
There’s a direct path to a publicly attributed hack, the account is new, the movement pattern matches laundering, and the FBI has named a state-linked actor, which adds sanctions risk.
6. Recommended action
Hold the deposit pending review. Don’t release or return it.
Escalate to the compliance lead (MLRO) for a decision on suspicious activity reporting and sanctions screening.
Ask the customer, through the normal review process, where the ETH came from and for supporting evidence. Don’t reveal the suspicion.
7. What I’d check next
Whether other customers received funds from the same intermediate addresses.
Whether this account shares devices or IP addresses with other flagged accounts.
Any updates from analytics providers or law enforcement on addresses linked to the case.
Why this note works
It separates evidence from inference. Sections 3 and 4 make clear what’s proven and what isn’t. In AOB’s hiring discussions, that separation comes up more than anything else.
It doesn’t call anyone a criminal. It describes what the evidence shows and leaves the decision to the right person.
It ends with a decision and next steps, so a manager can act on it in two minutes.
Every on-chain claim can be checked by anyone with a block explorer.
Write your own
Pick a public hack or scam with good reporting behind it.
Trace a few hops yourself, using a block explorer such as Etherscan and free tools like Breadcrumbs or Arkham.
Follow the seven headings above, and label anything you invent.
Keep it to one page.
Post your note as a reply below. I’ll feature the clearest ones in the blockchain forensics hub. If you’re wondering how to show this kind of work without exposing past clients, see case notes without client data.
Sources
Nansen, Bybit hack: what happened and where are the funds going on-chain, February 2025
The Block, Bybit hackers move over half the stolen ETH onto Bitcoin, FBI confirms Lazarus, 27 February 2025
CryptoSlate, Bybit CEO says $1 billion of stolen assets still trackable, 4 March 2025