A US federal court has granted crypto exchange Bybit permission to conduct expedited discovery as it attempts to identify accounts and trace assets linked to the $1.5 billion hack attributed to North Korea.
The court order gives Bybit access to information that could help identify individuals and entities allegedly involved in moving the stolen cryptocurrency through exchanges and other platforms operating in or connected to the United States.
Bybit Receives Expedited Discovery Approval
Court records unsealed Thursday show that Bybit filed a lawsuit under seal on June 18 against North Korea, its Reconnaissance General Bureau, the Lazarus Group and 20 unidentified defendants.
US court records on CourtListener
A federal judge granted Bybit's request for expedited discovery on June 19.
The decision allows the exchange to seek information from platforms that may have handled some of the stolen funds. The requested information includes:
Account-holder identities
Account balances
Transaction histories
Information related to cryptocurrency transfers
Other records that could help identify alleged intermediaries
Bybit said some platforms had indicated they would cooperate with the investigation if presented with a valid court order.
The discovery process could therefore provide the exchange with a legal mechanism to pursue funds that remain traceable instead of relying exclusively on a judgment against North Korea.
Most of the Stolen Cryptocurrency Is Now Difficult to Trace
Bybit said that approximately 90.2% of the stolen assets had become untraceable by the time it filed its lawsuit.
According to the exchange, the funds moved through a combination of cryptocurrency mixers, cross-chain bridges and over-the-counter trading channels, making the movement of the assets increasingly difficult to follow.
The remaining 9.8% was linked to identifiable wallets.
Of the total stolen amount, approximately 5.3%, or $75.5 million, had either been frozen or recovered by the time of the June 18 filing.
The figures represent a significant deterioration in traceability compared with earlier estimates.
More than a year ago, Bybit CEO Ben Zhou said approximately 68.57% of the stolen funds remained traceable.
Court Orders Also Restrict Movement of Traceable Assets
Alongside the discovery order, Bybit obtained a temporary restraining order on June 19 that prevented unidentified defendants from transferring certain traceable assets.
The court subsequently renewed the order on July 16.
On July 30, the court also partially granted Bybit's request for a preliminary injunction.
Some exhibits and other court records remain sealed.
These measures are important because cryptocurrency can be moved rapidly across wallets and blockchain networks. Restricting the movement of identified assets while discovery proceeds could give Bybit additional time to determine who controls the relevant accounts and where the funds ultimately originated.
How the $1.5B Bybit Hack Happened
The attack occurred on Feb. 21, 2025, when hackers compromised infrastructure associated with Safe Wallet, a platform used by Bybit for transaction management.
Investigators determined that compromised credentials belonging to a Safe developer were used to introduce malicious code into the company's cloud infrastructure.
The attackers then exploited that access to manipulate a transaction and steal approximately $1.5 billion worth of cryptocurrency from Bybit.
The scale of the incident made it one of the largest cryptocurrency thefts ever recorded.
FBI Attributes the Attack to North Korea
The US Federal Bureau of Investigation attributed the theft to North Korea on Feb. 26, 2025.
FBI statement on the Bybit theft
US authorities have repeatedly linked North Korean hacking groups, including the Lazarus Group, to major cryptocurrency thefts.
The funds stolen from Bybit were subsequently moved through numerous wallets and services, with investigators tracking their movement across different blockchain networks.
Bybit's latest legal action represents an effort to recover the portion of those assets that remains identifiable.
Bybit Seeks Damages and Return of Stolen Assets
The lawsuit does more than seek information about the stolen cryptocurrency.
Bybit is seeking the return of the assets along with approximately $1.5 billion in compensatory damages.
The exchange is also seeking punitive damages and treble damages under the US Racketeer Influenced and Corrupt Organizations Act (RICO).
The defendants named in the lawsuit include North Korea, its Reconnaissance General Bureau, the Lazarus Group and 20 unidentified parties.
The unidentified defendants are particularly important to the discovery process because Bybit is seeking to determine the identities of parties allegedly involved in receiving or transferring the stolen funds.
Why the Court Decision Matters for Crypto
The case highlights the growing role of traditional legal systems in cryptocurrency asset recovery.
Although blockchain transactions are publicly visible, identifying the real-world individuals behind wallets can be considerably more difficult, particularly when stolen assets are moved through mixers, bridges and multiple exchanges.
Court-authorized discovery can give victims a way to obtain information from centralized platforms that may otherwise be protected by privacy or data-access restrictions.
For crypto exchanges and other digital-asset businesses, the case could also reinforce the importance of cooperation between blockchain investigators, exchanges and law enforcement agencies when stolen assets pass through regulated jurisdictions.
What Happens Next?
Bybit's immediate objective is to identify the parties associated with the remaining traceable funds and prevent those assets from being moved beyond recovery.
The expedited discovery process could provide information about accounts, transaction histories and balances held at platforms with US operations.
However, recovering the remaining assets may still prove difficult. Bybit itself estimates that more than 90% of the stolen funds were already untraceable as of the lawsuit's filing.
The case therefore demonstrates both the transparency and limitations of blockchain investigations: transactions can remain permanently visible onchain, but tracing them to identifiable people or recovering assets after multiple transfers can become increasingly difficult.
Conclusion
The US court's decision gives Bybit a new legal avenue to pursue cryptocurrency stolen in the $1.5 billion North Korea-linked hack.
With expedited discovery, temporary asset restrictions and a preliminary injunction already in place, the exchange can seek information from platforms that may have interacted with the stolen funds.
However, the recovery challenge remains substantial. Bybit says 90.2% of the stolen assets had become untraceable, while only about $75.5 million had been frozen or recovered by the June 18 filing.
The case will now test how effectively court-backed discovery, blockchain analysis and international cooperation can be combined to recover cryptocurrency stolen in a major cyberattack.
