After a cryptoasset hack, assets may be traceable but difficult to recover. Chainalysis estimates that more than $3.4 billion in cryptoassets was stolen in 2025, with $2.02 billion attributed to North Korea-linked groups. In Korea, about 44.5 billion won in Solana-based assets left Upbit in November 2025 (p.24).
Can stolen assets be recovered? A practicing litigation lawyer's answer is 'rarely'. Blockchain transfers settle immediately, finally and across borders, while freezing orders, judgments and international judicial cooperation move slowly within national systems (p.24).
Post-incident asset freezing and dispute resolution therefore matter as much as security. Users can now check dispute clauses and inheritance procedures, while businesses can review emergency remedies and key management documentation (p.23, p.25).
This article draws on contributions by two lawyers in KCBCA Signals Vol.1 Issue 1 (p.22–25).
Why stolen cryptoassets are hard to recover
In his KCBCA Signals contribution, lawyer Heo Wang says the problem is not insufficient encryption. The structural gap lies in the mismatch between immediate, final, borderless transfers and slow, nationally organized legal procedures that rely on paperwork (p.24).
The reach of losses is also widening. As stablecoins are used for payments, remittances and wages, hacks and mistaken transfers directly affect merchants' operating funds, family savings and estates, as well as traders' accounts (p.24).
Theft and laundering patterns of North Korean hacking groups
The $2.02 billion stolen by North Korea-linked groups in 2025 includes $1.5 billion from Bybit alone. Their major theft proceeds are typically laundered in cycles of about 45 days, while cross-border requests for evidence or assets can take months (p.24).
Investigators viewed the November 2025 Upbit hack as linked to the Lazarus Group. Upbit also suffered a theft in 2019. It could cover this loss with its own reserves, but the contributor notes that smaller operators cannot do the same (p.24).
In September 2026, about $388 million also left the overseas exchange Bitget, but only about $1.1 million had been frozen by early October. Its CEO said he did not expect much to be recovered, and the company absorbed the loss with its own capital. The company described the methods as very similar to those of North Korean hacking groups, but the investigation report did not identify who was responsible. (CNBC, October 2, 2026)
Asset freezing currently depends on coordination after an incident
After the Upbit incident, traceable assets were frozen through case-by-case coordination with token issuers. Heo Wang says freezing should be 'a rule, not a favor' (p.25).
What needs to change in recovery systems?
The core proposal is to treat recovery capability as a licensing requirement, rather than a task left until after an incident (p.25).
| Proposal | Details |
|---|---|
| A legal duty to maintain freezing capability | Licensed issuers and custodians freeze and reissue assets under lawful orders, within defined time limits and according to published standards |
| Fast judicial procedures | Dedicated provisional attachment procedures for on-chain assets identified by address, and service rules for exchanges and issuers (mandatory domestic representatives for overseas operators) |
| Cross-border golden-hour coordination | A 24-hour contact network connecting regulators, financial intelligence units, exchanges and issuers in Korea, Japan, Singapore, Hong Kong, the UAE and the US, using Travel Rule infrastructure |
| Succession planning | Custodians establish inheritance procedures for a key holder’s death or incapacity; companies document key succession as they would corporate authority |
The golden-hour proposal aims for cooperation to operate on a timescale of days because laundering also proceeds on that timescale (p.25).
Gaps in dispute resolution and three proposed pillars
Lawyer Youjoun Ha identifies three barriers courts face in cryptoasset disputes. When the counterparty is only a wallet address, the relevant national court's jurisdiction is unclear; smart contract code and on-chain fund flows are difficult to assess; and judgments delivered years later may have limited value in markets moving by the hour (p.22).
The alternative rests on three pillars: mandatory specialized arbitration linked to licensing, panels with expertise in both law and blockchain technology, and cross-border enforcement of arbitral awards under the New York Convention, which has 172 contracting countries (p.22–23).
The contributions also address Korea's situation. Korea's Virtual Asset User Protection Act (2024) protects deposits and regulates unfair trading but provides no specialized dispute procedure (p.23). As of the contribution's writing in September 2026, the government had not yet submitted its proposal for the next-stage Digital Asset Basic Act, and final passage could slip to the first half of 2027 (p.24).
What users and businesses can check now
Even if cryptoasset hacks cannot be entirely prevented, the path after an incident can be checked in advance.
| Who | What to check |
|---|---|
| Users | Dispute clauses in exchange and custody service terms, including arbitration and jurisdiction (p.23) |
| Users | Custody service procedures for inheritance and incapacity (p.25) |
| Businesses | Arbitration clauses and the seat of arbitration in user terms and transaction agreements (p.23) |
| Businesses | Emergency remedies in each jurisdiction holding assets, including emergency arbitrators and freezing orders (p.23) |
| Businesses | Custody, key management and key succession documentation that can be recognized in court (p.23, p.25) |
Frequently asked questions
Q1. Is the matter over if an exchange compensates users?
Compensation and recovery differ. Upbit covered its losses with its own reserves, but smaller operators cannot do the same (p.24). Procedures to recover stolen assets and specialized dispute procedures remain gaps (p.23, p.25).
Q2. If blockchains are traceable, will assets eventually be recovered?
Tracing may be possible, but timely recovery across borders is difficult. When losses occur simultaneously in several countries, procedures and rules differ, and individual investors in countries without cross-border remedies may be pushed to the back of the queue (p.23).
Q3. What happens if the key holder dies?
Assets can remain locked forever if the key holder dies or loses decision-making capacity. The paper calls this a 'silent recovery failure'. Custodians need inheritance procedures, and companies need to document key succession (p.25).
At a glance
- Tracing, freezing, compensation and recovery after a cryptoasset hack are different
- Transfers and laundering are fast, while legal procedures are slow and organized nationally
- Proposed measures include freezing duties, rapid provisional attachment, golden-hour cooperation and key succession
- Dispute resolution also needs licensing-linked arbitration and cross-border enforcement
Security to prevent cryptoasset hacks and systems to recover stolen assets need separate preparation. Start by checking the dispute clauses in the terms of the exchange you use today.
Read KCBCA Signals Vol.1 Issue 1 in full (p.22–25)
References: KCBCA Signals Vol.1 Issue 1; Heo Wang (lawyer at Wins Law Firm), “Security Is Not Recovery”, p.24–25; Youjoun Ha (Partner, Taegwang Law Firm), “Digital Assets Have a Dispute Problem”, p.22–23. Sources cited by the original contributions: Chainalysis, The Herald Business, Blockhead (citing Yonhap News Agency), CCN. Overseas case: CNBC (October 2, 2026). This is not investment advice.
