A public record of a theft should be an investigator’s advantage. In crypto, the difficulty is turning that record into an explanation of who controls the money, where it has gone and whether anyone can stop it moving again.

Popoola Kayode, known professionally as PopeBlack, addresses this in an article, Inside the Hunt for the Bybit Billion: What Happens After Crypto Theft? His focus is tracing value as it changes assets and passes through intermediaries.

The Bybit theft provides a particularly consequential example. Elliptic records that approximately $1.46 billion in ETH and ERC-20 tokens was taken on 21 February 2025. Its six-month review describes repeated transfers between networks and privacy services, with some proceeds…