US Court Backs Bybit’s Bid to Trace $1.5B Hack Funds
A U.S. federal judge granted Bybit expedited discovery to trace assets from the $1.5 billion North Korea-linked hack, with 90% of funds now untraceable. The exchange filed a lawsuit against North Korea and Lazarus Group, securing a restraining order and freezing $75.5 million.
Quick Take
Court granted Bybit expedited discovery to trace stolen assets from the 2025 Lazarus hack.
90.2% of stolen funds are untraceable after passing through mixers and bridges.
Bybit froze $75.5M and seeks account identities from US-based exchanges.
Lawsuit targets North Korea, Reconnaissance General Bureau, Lazarus, and 20 John Does.
Market Impact Analysis
NeutralLegal proceedings yield no immediate price impact; broad market effect is muted as the hack was already priced in and most funds are lost.
Speculation Analysis
Key Takeaways
- A US federal judge has granted Bybit expedited discovery to trace assets stolen in the $1.5 billion North Korea-linked hack, enabling pursuit of remaining traceable funds.
- Over 90% of the stolen funds are now untraceable after being passed through mixers, cross-chain bridges, and OTC dealers.
- Bybit has frozen approximately $75.5 million and is compelling US-based exchanges to disclose account-holder identities and transaction histories.
- The lawsuit targets North Korea, its Reconnaissance General Bureau, the Lazarus Group, and 20 unidentified defendants.
What Happened
On June 19, a US federal judge granted Bybit expedited discovery, allowing the crypto exchange to identify intermediaries and trace remaining assets from the $1.5 billion hack linked to North Korea's Lazarus Group. The lawsuit, filed under seal a day earlier, targets North Korea, its Reconnaissance General Bureau, the hacking group, and 20 John Doe defendants. The order gives Bybit the authority to compel US-based exchanges to hand over account-holder identities, balances, and transaction histories for wallets that received stolen funds. A temporary restraining order was also issued, preventing unknown defendants from moving certain traceable assets, later extended and partially converted to a preliminary injunction.
The Numbers
The hack, which occurred on February 21, 2025, drained approximately $1.5 billion from Bybit via compromised Safe Wallet infrastructure. As of the June 18 filing, 90.2% of the funds had become untraceable after passing through mixers, cross-chain bridges, and OTC dealers. Only 9.8% remained traceable, with 5.3% ($75.5 million) frozen or recovered. That marks a sharp decline from early estimates, when Bybit's CEO said 68.57% was traceable right after the attack. The rapid obfuscation highlights the challenge in recovering stolen crypto.
Why It Happened
The hack was executed by North Korean state-sponsored group Lazarus, which compromised Safe Wallet's infrastructure using a developer's stolen credentials to inject malicious code. Bybit pursued legal action in US courts because some traceable funds flowed through exchanges operating or maintaining infrastructure in the US. The expedited discovery is a practical route to pursue the small portion of assets still visible, rather than relying solely on a judgment against North Korea. The exchange is seeking the return of assets, $1.5 billion in compensatory damages, and punitive and treble damages under the RICO Act.
Broader Impact
This case sets a precedent for crypto exchanges using the US legal system to trace stolen assets, even when most funds are laundered. By obtaining court orders to unmask account holders on compliant platforms, victims may recover otherwise unreachable funds. It also puts pressure on US-based intermediaries to cooperate, potentially making the crypto ecosystem a harder target for state-sponsored theft.
What to Watch Next
- Whether US-based exchanges comply with discovery orders and release account data, potentially identifying bad actors.
- If additional funds can be frozen or recovered as tracing continues, despite the high untraceability rate.
- Potential international legal developments or sanctions targeting North Korea's hacking infrastructure.
This article is for informational purposes only and does not constitute financial advice.
Always late to trends?
Join for the latest news, insights & more.
Disclaimer: Bytewit is an independent media outlet that delivers news, research, and data.
© 2026 Bytewit. All Rights Reserved. This article is for informational purposes only.
