A federal judge has authorised Bybit to pursue discovery against United States-based platforms in its ongoing legal battle over assets stolen during a significant cryptocurrency hack. The exchange is seeking information regarding account identities, balances and transaction histories related to the $1.5 billion theft, linked to North Korea’s Reconnaissance General Bureau and the Lazarus Group. This judicial action follows a series of developments in the case that began with a sealed lawsuit filed by Bybit on June 18th, 2024.
The court granted an expedited discovery order on June 19th, 2024, allowing Bybit to target platforms operating within the US. A temporary restraining order was subsequently obtained preventing transfers of assets linked to the hack. This measure was renewed on July 16th, 2024, reflecting the continued urgency surrounding the recovery efforts.
A preliminary injunction was partially granted on July 30th, 2024, providing a legal framework for Bybit’s pursuit of traceable funds. The lawsuit alleges damages totalling $1.5 billion, encompassing compensatory, punitive and treble damages under the Racketeer Influenced and Corrupt Organizations Act. Ben Zhou, CEO of Bybit, has publicly stated his commitment to tracking the stolen funds.
The hack occurred on February 21st, 2025, following a compromise of Safe Wallet’s infrastructure. The FBI attributed the theft to North Korea in June 26th, 2025. Approximately 90.2% of the initial $1.5 billion has become untraceable after navigating through mixers, cross-chain bridges and over-the-counter dealers.
As of February 2024, Ben Zhou indicated that approximately 68.57% of the funds remained traceable. To date, $75.5 million – representing roughly 5.3% of the total stolen value – has been frozen or recovered. Efforts continue to identify the remaining assets and those involved in facilitating their movement.
The legal action centres on tracing assets that have passed through US-based exchanges and platforms. It highlights the significant challenge faced by law enforcement agencies attempting to recover illicitly obtained cryptocurrency funds, particularly when utilising complex layers of obfuscation. Further uncertainty remains surrounding the identities of the 20 unidentified defendants named in the initial lawsuit and the extent of cooperation anticipated from relevant US entities. The ultimate success of Bybit’s efforts hinges on achieving further clarity regarding these critical aspects of the case.
Written by Daniel Brooks
Security Desk
