US Court Grants Bybit Expedited Discovery in Pursuit of $1.5 Billion North Korea-Linked Hack Assets

United States court records, unsealed on Thursday, reveal that a federal judge has authorized crypto exchange Bybit’s efforts to trace assets stolen in the massive $1.5 billion hack linked to North Korea. The court granted Bybit expedited discovery, a crucial legal tool that will allow the exchange to pursue the recovery of a portion of the illicitly obtained funds.

The legal proceedings were initiated under seal by Bybit on June 18, with the lawsuit naming North Korea, its primary intelligence agency the Reconnaissance General Bureau, the notorious Lazarus Group, and twenty unidentified defendants. The court’s swift decision to grant Bybit’s request for expedited discovery occurred just one day later, on June 19, underscoring the urgency and perceived validity of the exchange’s claims.

This judicial backing for expedited discovery provides Bybit with a practical pathway to identify alleged intermediaries involved in the laundering of the stolen cryptocurrency. It enables the exchange to pursue a fraction of the assets that remain traceable, moving beyond the sole recourse of obtaining a judgment against North Korea, a notoriously difficult entity to enforce legal rulings against.

In its formal complaint, Bybit alleged that some of the traceable stolen assets made their way to cryptocurrency exchanges that operate or maintain infrastructure within the United States. The exchange sought access to account-holder identities, current balances, and detailed transaction histories from these platforms. Bybit’s legal team indicated that certain exchanges had signaled a willingness to cooperate with such requests once a court order was in place.

Bybit Reports Significant Untraceability of Stolen Funds

Further legal actions by Bybit included the securing of a temporary restraining order on June 19. This order aimed to prevent the unidentified defendants from transferring specific traceable assets. The court subsequently renewed this order on July 16 and, on July 30, partially granted Bybit’s request for a preliminary injunction. Despite these developments, certain exhibits and other records related to the case remain sealed, indicating ongoing sensitive investigations.

As of the date of the June 18 filing, Bybit reported a stark reality: 90.2% of the stolen assets had become untraceable. This significant portion had passed through complex laundering mechanisms, including cryptocurrency mixers, cross-chain bridges, and over-the-counter (OTC) trading desks, designed to obfuscate the trail of funds. The remaining 9.8% of the stolen assets were traced to identifiable wallets. Of this traceable amount, approximately 5.3% of the total stolen funds, equivalent to about $75.5 million, had reportedly been frozen or recovered by the exchange and its collaborators.

These figures represent a significant decrease in traceability compared to an earlier assessment made by Bybit. Over a year prior to the June filing, Bybit CEO Ben Zhou had stated that approximately 68.57% of the stolen funds remained traceable. The current statistics highlight the effectiveness of sophisticated money laundering techniques employed by sophisticated cybercriminals.

The devastating hack occurred on February 21, 2025. Forensic investigations later revealed that attackers gained access by compromising the infrastructure of Safe Wallet. Investigators determined that compromised credentials belonging to a Safe developer were exploited, allowing the attackers to inject malicious code into the platform’s cloud infrastructure. The Federal Bureau of Investigation (FBI) officially attributed the theft to North Korea on February 26, 2025, based on their extensive forensic analysis.

Through its lawsuit, Bybit is not only seeking the return of the stolen assets but is also pursuing substantial damages. The exchange is claiming approximately $1.5 billion in compensatory damages, alongside punitive damages and treble damages. These claims are being brought under the stringent provisions of the United States Racketeer Influenced and Corrupt Organizations (RICO) Act, a federal law designed to combat organized crime and its illicit financial activities.

The case underscores the persistent challenges posed by state-sponsored cybercrime and the complex legal and technical hurdles involved in recovering stolen digital assets. Bybit’s proactive legal strategy and the court’s willingness to grant expedited discovery represent a significant step in holding those responsible accountable and potentially reclaiming a portion of the substantial losses incurred. The ongoing legal battle is expected to shed further light on the methods used by North Korea-linked hacking groups and the vulnerabilities within the broader cryptocurrency ecosystem.