US court approves Bybit's request to trace funds from $1.5B North Korea hack
Bybit gains court approval to track stolen funds linked to North Korea through US legal channels.
1Expedited Discovery Approval
A US court has approved Bybit's request for expedited discovery to trace assets stolen in the $1.5 billion North Korea-linked hack. This ruling allows Bybit to demand account identities, balances, and transaction histories from platforms operating in the US. Court records show Bybit filed the lawsuit under seal on June 18 against North Korea, its Reconnaissance General Bureau, the Lazarus Group, and 20 unidentified defendants.
2Legal Grounds of the Case
Bybit alleges that some traceable assets reached exchanges operating in the US. The company sought account holder identities, balance information, and transaction histories, stating these platforms would cooperate after receiving a court order. Bybit also obtained a temporary restraining order on June 19 preventing unidentified defendants from transferring certain traceable assets. This order was renewed on July 16 and partially granted a preliminary injunction on July 30.
3Status of Traceable Assets
According to Bybit's June 18 filing, 90.2% of stolen assets became untraceable after passing through mixers, cross-chain bridges, and OTC dealers. The remaining 9.8% was traced to identifiable wallets, with 5.3% (about $75.5 million) frozen or recovered. These figures show a significant drop from a year ago when Bybit CEO Ben Zhou stated 68.57% of funds remained traceable.
4Background of the Hack
The hack occurred on February 21, 2025, when attackers compromised Safe Wallet's infrastructure. Forensic investigators found that compromised credentials of a Safe developer allowed malicious code injection. The FBI attributed the theft to North Korea on February 26, 2025. Bybit's lawsuit seeks return of stolen assets, approximately $1.5 billion in compensatory damages, and punitive damages under the US RICO Act.
5Significance of Legal Process
Bybit's case highlights the importance of legal mechanisms in crypto asset theft incidents. The company is seeking treble damages under the RICO Act, testing the effectiveness of legal frameworks against international cybercrime. Court decisions in this case may set precedents for similar future cases involving state-sponsored hacking activities and crypto asset recovery efforts.
6Industry Implications
After its major 2025 hack, Bybit made what CoinGecko called a 'slow but steady comeback,' important for restoring industry trust. However, this new lawsuit reminds crypto exchanges to review their security measures and legal preparedness. Legal strategies against state-sponsored cyberattacks are becoming increasingly critical for cryptocurrency businesses operating globally.
7International Dimension
The case brings renewed attention to allegations of North Korea targeting the international financial system through cyber operations. State-sponsored hacking groups like Lazarus pose significant threats to global security and financial stability. Bybit's lawsuit represents a rare example of private sector legal action against state-sponsored cybercrime, testing legal countermeasures in this emerging battlefield.
8Conclusions and Implications
The US court's approval of Bybit's expedited discovery request sets an important precedent for crypto asset tracing. This decision demonstrates the effectiveness of legal processes in tracking and recovering stolen digital assets. It serves as a significant case study for how private companies can use legal tools against state-sponsored cybercrime. The outcome may influence future security and regulatory standards in the cryptocurrency industry.