Court clears Bybit to chase the money trail behind its $1.5B North Korea hack

What happened

Court records unsealed on Thursday confirm that a US federal judge has backed Bybit's attempt to trace assets stolen in the $1.5 billion hack that investigators linked to North Korea. The exchange filed its lawsuit under seal on June 18, naming North Korea itself, its Reconnaissance General Bureau, the Lazarus Group, and 20 unidentified defendants. The court granted expedited discovery the following day, June 19.

Expedited discovery is the practical engine of the case: it lets Bybit demand account-holder identities, balances, and transaction histories from exchanges and platforms that operate or maintain infrastructure in the US, rather than depending entirely on a legal judgment against a state that will almost certainly never pay it. Bybit's complaint states that some of the traceable stolen assets reached exchanges with US operations, and that certain platforms had already signaled they'd cooperate once a court order was in hand.

The underlying theft happened on February 21, 2025, after attackers compromised Safe Wallet's infrastructure. Forensic investigators traced the breach to stolen credentials belonging to a Safe developer, which let attackers inject malicious code into the company's cloud infrastructure. The FBI publicly attributed the theft to North Korea five days later, on February 26, 2025.

Why it matters

The case turns a slow-moving criminal attribution story into an active civil asset hunt. North Korea isn't going to show up and pay a judgment, so the discovery order matters far more than the eventual verdict: it's the mechanism that could actually put names to the wallets and OTC desks that touched the stolen funds.

The case also carries a broader signal for the industry: Bybit is leaning on the US Racketeer Influenced and Corrupt Organizations Act (RICO), which allows for treble damages — three times the proven loss — on top of compensatory and punitive damages. That's a far more aggressive posture than the criminal-referral-and-wait approach exchanges have typically taken after state-linked hacks.

The numbers

Bybit's own accounting, as stated in the June 18 filing, shows how quickly stolen crypto becomes unreachable once it starts moving through laundering infrastructure.

68.57% Traceable, ⚠️ "more than a year ago"

9.8% Traceable, as of June 18 filing

Source figures only. Bybit CEO Ben Zhou's 68.57% figure is dated only as "more than a year ago" relative to the June 18 filing — see flag below.

Market reaction

The source material contains no price data, trading volume, or sentiment indicators tied to this court ruling, and no market-moving language beyond the case's own dollar figures.

What's next / things to watch

The docket already shows a pattern of the court siding with Bybit on interim relief: a temporary restraining order granted June 19, renewed July 16, and a preliminary injunction partially granted July 30. Some exhibits and other records in the case remain sealed, so the full list of named or newly identified defendants isn't public yet.

With expedited discovery in hand, the next concrete step is exchanges and platforms with US operations turning over account identities, balances, and transaction histories tied to the traceable 9.8% of funds. Whether that produces usable leads on the 20 unidentified defendants — or simply confirms dead ends — is the open question the source doesn't yet answer.

FAQs

Compiled from unsealed US court records as reported. Figures current only as of the underlying filing dates cited above.