- Published on
US court backs Bybit’s bid to trace funds from $1.5B North Korea hack
- Authors
- Name
- DeepHorus
A US federal judge has granted Bybit expedited discovery to trace assets stolen in the $1.5 billion North Korea-linked hack, according to court records unsealed Thursday. The order lets the crypto exchange seek account identities, balances, and transaction histories from platforms with US operations. Bybit filed its lawsuit under seal on June 18 and received court approval the next day.
The theft occurred on Feb. 21, 2025, after attackers compromised Safe Wallet’s infrastructure using stolen developer credentials. The FBI attributed the attack to North Korea on Feb. 26, naming the Lazarus Group and Reconnaissance General Bureau. Bybit named those entities as defendants along with 20 unidentified parties.
In its complaint, Bybit said some traceable assets reached exchanges operating in the US. The company sought account-holder identities, balances, and transaction histories, noting that some platforms indicated they would cooperate after receiving a court order. Bybit also obtained a temporary restraining order on June 19, renewed July 16, with a partial preliminary injunction granted July 30.
The discovery authority offers a practical route to identify intermediaries and recover traceable funds without relying solely on a judgment against North Korea. As of June 18, 90.2% of stolen assets had become untraceable after passing through mixers, bridges, and OTC dealers. The remaining 9.8% were traced to identifiable wallets; 5.3% — about $75.5 million — have been frozen or recovered.
That marks a sharp drop from more than a year ago, when CEO Ben Zhou said 68.57% of funds remained traceable. Industry tracker CoinGecko noted Bybit made a 'slow but steady comeback' in 2025 after the hack. The lawsuit seeks return of stolen assets, about $1.5 billion in compensatory damages, plus punitive and treble damages under RICO.
The court's expedited discovery signals growing willingness among US judges to help crypto firms pursue state-backed hackers. Next, Bybit will serve discovery requests on US-based platforms and monitor frozen wallets. The partial injunction helps preserve traceable assets before further laundering.
This case reflects a larger pattern of North Korea funding weapons programs through cyber theft, while crypto exchanges face ever-evolving threats. Legal tools are emerging as critical complements to on-chain tracking and industry cooperation. The unsealed records show that courts can play a key role in recovering digital assets, even when the ultimate adversary is a state.
