A federal judge granted crypto exchange Bybit expedited discovery powers, allowing it to pursue assets from a $1.5 billion hack linked to North Korea. Court records unsealed Thursday revealed the June 19 order.
Bybit filed the lawsuit under seal on June 18, naming North Korea, its Reconnaissance General Bureau, the Lazarus Group and 20 unnamed defendants. The court approved Bybit's request for swift discovery the following day.
The discovery authority lets Bybit demand account identities, balances and transaction histories from platforms maintaining operations or infrastructure within the United States. Bybit said in its complaint that some traceable assets had moved through American-based exchanges.
As of the June 18 filing, Bybit reported 90.2 percent of the stolen assets had become untraceable. Attackers routed the funds through mixers, cross-chain bridges and over-the-counter dealers.
The remaining 9.8 percent was traced to identifiable wallets. Of the total, approximately $75.5 million—representing 5.3 percent—has been frozen or recovered.
That traceability figure has collapsed sharply. Bybit CEO Ben Zhou said at the time of the hack that 68.57 percent of the funds remained traceable.
The hack occurred Feb. 21, 2025, when attackers compromised Safe Wallet's infrastructure. Forensic investigators determined that compromised credentials belonging to a Safe developer allowed malicious code injection into the cloud infrastructure.
The Federal Bureau of Investigation attributed the theft to North Korean actors on Feb. 26, 2025.
Bybit seeks return of the stolen assets and approximately $1.5 billion in compensatory damages. The company also pursues punitive and treble damages under the U.S. Racketeer Influenced and Corrupt Organizations Act.
The court issued a temporary restraining order on June 19, preventing the unidentified defendants from transferring certain traceable assets. That order was renewed July 16, and the court partially granted a preliminary injunction July 30.
The unsealed court records do not disclose the identities of the 20 unnamed defendants or specific wallet details. Some exhibits and other records in the case remain sealed.
