North Korea was linked to the February 2025 Bybit theft of about USD 1.5 billion in Ethereum, and TRM observed the laundering operation moving at unusually high speed. Within days, hundreds of millions of dollars had been shifted through decentralized exchanges and cross-chain services, with the vast majority of stolen ETH bridged to Bitcoin mainly through THORChain-linked services. The excerpt says the second laundering phase began as initial Bitcoin tranches entered mixers including Wasabi and CryptoMixer, creating tracing challenges and likely false positives for investigators using public tools. The scale, speed, and repeated bridge-and-mix pattern show how DPRK-linked operators are trying to overwhelm compliance teams, blockchain analysts, and law enforcement.