Bybit gets court green light to play crypto detective on Lazarus's leftovers 🕵️

A US federal judge has authorized crypto exchange Bybit to use expedited discovery to trace assets connected to the $1.5 billion hack attributed to North Korea, after court records were unsealed on Thursday. The exchange filed the lawsuit under seal on June 18 in the US District Court for the District of Columbia against the Democratic People's Republic of Korea (DPRK), its Reconnaissance General Bureau (RGB), the Lazarus Group and 20 unidentified John Doe defendants. The court granted Bybit's request for expedited discovery on June 19.

The discovery authority gives Bybit a practical route to identify alleged intermediaries and pursue a small portion of stolen assets that remains traceable, rather than relying solely on a judgment against North Korea. In its complaint, Bybit alleged that some traceable assets reached exchanges operating or maintaining infrastructure in the United States, and sought account-holder identities, balances and transaction histories, saying certain platforms had indicated they would cooperate after receiving a court order.

Bybit also obtained a temporary restraining order on June 19 preventing the unidentified defendants from transferring certain traceable assets. The court renewed the order on July 16 and partially granted Bybit's request for a preliminary injunction on July 30, which prohibits the transfer or dissipation of identified assets connected to the case while litigation continues. Some exhibits and other records remain sealed.

As of the June 18 filing, Bybit said 90.2% of the stolen assets had become untraceable after passing through mixers, cross-chain bridges and over-the-counter dealers. The remaining 9.8% had been traced to identifiable wallets, including 5.3% of the total, about $75.5 million, that had been frozen or recovered. The figures mark a sharp drop from more than a year ago, when CEO Ben Zhou said 68.57% of the funds remained traceable. The stolen assets consisted of approximately $1.5 billion in Ethereum (over 400,000 ETH and stETH), and the Bybit hack made up a bulk of the $2.02 billion in crypto stolen by North Korea that year. North Korean hackers have stolen a total of $6.75 billion worth of crypto, according to data from Chainalysis.

The hack occurred on Feb. 21, 2025, after attackers compromised Safe Wallet's infrastructure, with forensic investigators saying compromised credentials belonging to a Safe developer allowed the attackers to inject malicious code into its cloud infrastructure. The FBI attributed the theft to North Korea on Feb. 26, 2025. The lawsuit shows Bybit is seeking the return of the stolen assets, approximately $1.5 billion in compensatory damages, punitive damages and treble damages under the US Racketeer Influenced and Corrupt Organizations Act. "The order is intended to preserve identified stolen digital assets while the litigation continues, representing an important step in Bybit's ongoing efforts to recover funds, support international law enforcement investigations, and reinforce accountability for large-scale cybercrime," Bybit said in the release. "Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable," Ben Zhou, co-founder and CEO of Bybit, said in a statement.