Marc Schwartz, CEO and founder of Ledger Peaks, LLC, was engaged as Chief Restructuring Officer (“CRO”) by the debtors three months prior to their bankruptcy filings and served in this capacity throughout the bankruptcy proceedings. As part of the confirmed Plan, and pursuant to the Court’s order, the CRO was designated as an “Exculpated Party” alongside the debtors, the Creditors’ Committee, and each of its members. Consequently, Mr. Schwartz is protected under the exculpation provisions outlined in paragraph VI.C of the Plan.

Mr. Schwartz’s responsibilities, as defined in his engagement letter, the related application for his appointment as CRO, and the court order authorizing his employment, were closely aligned with the duties of a bankruptcy trustee under the Bankruptcy Code. This alignment was a key factor in the Court’s determination to extend exculpation to the CRO.

The confirmation of the Plan and the inclusion of the CRO as an Exculpated Party underscore the significance of the CRO’s role in the restructuring process and affirm the Court’s recognition of his adherence to fiduciary responsibilities throughout the bankruptcy case.

The post Schwartz engaged as Chief Restructuring Officer appeared first on Ledger Peaks.

[UPDATED: February 27, 2025; 9:40am EST] This blog has been updated to reflect the latest updates on the Bybit hack.

On February 21, 2025, Bybit, a prominent cryptocurrency exchange, experienced a significant security breach resulting in the loss of nearly $1.5 billion worth of ether (ETH). This incident stands as the largest digital heist in the history of cryptocurrency. Fortunately, Bybit is actively collaborating with industry experts, including Chainalysis, to trace the stolen assets. They have also launched a recovery bounty program, offering up to 10% of the recovered amount to individuals who assist in retrieving the stolen crypto.

In this blog, we’ll look at how the exploit occurred; the attackers’ tactics, techniques, and procedures (TTPs) and their consistency with the Democratic People’s Republic of Korea (DPRK); and how Chainalysis is collaborating with Bybit and law enforcement to help recover funds.

Details of the Bybit exploit

The Bybit hack serves as a stark reminder of the evolving tactics employed by state-sponsored cybercriminals, particularly those linked to the DPRK. As we recently revealed in our 2025 Crypto Crime Report, North Korea-affiliated hackers stole approximately $660.5 million across 20 incidents in 2023. In 2024, this number increased to $1.34 billion stolen across 47 incidents — a 102.88% increase in value stolen. The Bybit hack alone led to almost $160 million more stolen than all funds stolen by North Korea throughout 2024.

This attack highlights a common playbook used by the DPRK: orchestrating social engineering attacks and employing intricate laundering methods in an attempt to move stolen funds undetected. Funds from the Bybit exploit have also consolidated in addresses holding funds from other known DPRK-linked attacks, providing further evidence that the nation state actors are behind this latest incident.

Below is a step-by-step analysis of how the Bybit exploit unfolded: 

1. The compromise: The hackers gained access to a Safe developer’s computer to control the Safe UI that was specifically used for Bybit transactions. They then added the malicious JavaScript snipped to the frontend code, to make it appear that Bybit was signing a legitimate transaction, when in fact it was a malicious one.
2. Initiation of unauthorized transfers: During what appeared to be a routine transfer from Bybit’s Ethereum cold wallet to a hot wallet, Bybit unknowingly signed the malicious transaction, enabling the attackers to move approximately 401,000 ETH — valued at nearly $1.5 billion at the time of the exploit — to addresses under their control.
3. Asset dispersion through intermediary wallets: The stolen assets were then moved through a complex web of intermediary addresses. This dispersion is a common tactic used to obfuscate the trail and hinder tracking efforts by blockchain analysts.
4. Conversion and laundering: The hackers swapped significant portions of the stolen ETH for tokens including BTC and DAI. They also utilized decentralized exchanges (DEXs), cross-chain bridges, and a no-KYC instant swap service to move assets across networks.
5. Keeping funds dormant and strategic laundering: A notable portion of the stolen funds has remained idle across various addresses, a deliberate move often employed by North Korea-affiliated hackers. By delaying laundering efforts, they aim to outlast the heightened scrutiny that typically immediately follows such high-profile breaches.

The below Chainalysis Reactor graph showcases the complexity of the laundering efforts thus far: the web of intermediary addresses, token swaps, and cross-chain movements that not only attempt to obscure the stolen funds, but also demonstrate the far-reaching consequences of this exploit across the broader crypto ecosystem.

Industry collaboration in the wake of the Bybit hack

Despite the severity of Bybit’s attack, the inherent transparency of blockchain technology presents a significant challenge for malicious actors attempting to launder stolen funds. Every transaction is recorded on a public ledger, enabling authorities and cybersecurity firms to trace and monitor illicit activities in real time.

Collaboration across the crypto ecosystem is paramount in combating these threats. The swift response from Bybit, including its assurance to cover customer losses and its engagement with blockchain forensic experts, exemplifies the industry’s commitment to mutual support and resilience. By uniting resources and intelligence, the crypto community can strengthen its defenses against such sophisticated cyber attacks and work toward a more secure digital financial environment.

We are working with our global teams, customers, and partners across both the public and private sectors to support multiple avenues for seizure and recovery in response to this attack. Already, we’ve worked with contacts in the industry to help freeze more than $40 million in funds stolen from Bybit and continue to collaborate with public and private sector organizations to seize as much as possible. We will continue to provide updates on this matter.
Originally posted on the ChainAnalysis blog: https://www.chainalysis.com/blog/bybit-exchange-hack-february-2025-crypto-security-dprk/

The post From ChainAnalysis: Leveraging Transparency for Collaboration in the Wake of Record-Breaking Bybit Theft appeared first on Ledger Peaks.

Read the Full Article

The post Identifying and Tracking Crypto in Bankruptcy Proceeding – ABI’s Beyond the Quill appeared first on Ledger Peaks.

The post Podcast: expert Chris Roberts talks cryptocurrency theft and recovery appeared first on Ledger Peaks.

A native of South Korea, Harold is fluent in Korean and English. He holds a Bachelor of Science in Accounting and Master of Science in Accountancy from the University of Miami. Prior to earning his degrees, Harold served as a Sergeant and Intelligence Analyst in the Republic of Korea Army.

The post SALLC Adds to Litigation Practice appeared first on Ledger Peaks.

A native of India, Priya is fluent in English, Hindi, and Telugu. She holds a Bachelor of Science in Accounting and Finance from University of Texas – Dallas. In her academic career, Priya presented a paper entitled, “Gender and Its Role in Raising Money for Startups,” to panels at both Harvard University and Massachusetts Institute of Technology.

Priya Salagundla, PSalagundla@ledgerpeaks.com

The post SALLC Boosts Valuation Capabilities appeared first on Ledger Peaks.

Ledger Peaks, LLC is a multi-office, boutique litigation and expert services firm with practices in Forensic Accounting and Fraud Examination, Valuation Services, Financial Restructuring and Turnaround Services, State Receiverships, and Foreign Corrupt Practices Act Consulting.

Ledger Peaks, LLC is not a CPA firm.

The post Historically Underutilized Business and Minority Business Enterprise appeared first on Ledger Peaks.