Bybit Wins Court Support to Trace $1.5B North Korea Hack Funds

More than 90% of the proceeds have gone dark, leaving about $75.5 million frozen or recovered as Bybit pursues alleged intermediaries.

Bybit Wins Court Support to Trace $1.5B North Korea Hack Funds

DOGE

$0.07009

1.64%

TRX

$0.3275

0.07%

LINK

$8.26

1.62%

ZEC

$508.65

1.13%

ADA

$0.2009

0.66%

XRP

$1.03

1.37%

ETH

$1,916.73

1.16%

BTC

$65,000.32

1.28%

XMR

$380.64

3.12%

BNB

$593.55

1.05%

XLM

$0.1632

2.20%

SOL

$74.63

2.77%

HYPE

$54.37

1.84%

Written by

Ezra Reguerra

staff writer

Reviewed by

Yohan Yun

staff editor

Written by

Ezra Reguerra

staff writer

Reviewed by

Yohan Yun

staff editor

US court backs Bybit’s bid to trace funds from $1.5B North Korea hack

Latest News

Published

Aug 8, 2026

Expedited discovery allows the exchange to seek account identities, balances and transaction histories from platforms with US operations.

United States court records unsealed on Thursday show that a federal judge backed crypto exchange Bybit’s effort to trace assets stolen in the $1.5 billion North Korea-linked hack by granting the company expedited discovery.

According

to the records,  Bybit filed the lawsuit under seal on June 18 against North Korea, its Reconnaissance General Bureau, the Lazarus Group and 20 unidentified defendants. The court granted Bybit’s request for expedited discovery on June 19.

The discovery authority gives Bybit a practical route to identify alleged intermediaries and pursue a small portion of stolen assets that remains traceable, rather than relying solely on a judgment against North Korea.

In its complaint, Bybit alleged that some traceable assets reached exchanges operating or maintaining infrastructure in the US. The company sought account-holder identities, balances and transaction histories, saying certain platforms had indicated they would cooperate after receiving a court order.

Bybit says 90% of stolen funds became untraceable

Bybit also obtained a temporary restraining order on June 19 preventing the unidentified defendants from transferring certain traceable assets. The court renewed the order on July 16 and partially granted Bybit’s request for a preliminary injunction on July 30. Some exhibits and other records remain sealed.

As of the June 18 filing, Bybit said 90.2% of the stolen assets had become untraceable after passing through mixers, cross-chain bridges and over-the-counter dealers. The remaining 9.8% had been traced to identifiable wallets, including 5.3% of the total, about $75.5 million, that had been frozen or recovered.

The figures mark a sharp drop from more than a year ago, when Bybit CEO Ben Zhou said at the time that

68.57% of the funds remained traceable

.

Related:

Bybit made ‘slow but steady comeback’ in 2025 after massive hack: CoinGecko

The hack occured on Feb. 21, 2025, after attackers

compromised Safe Wallet’s infrastructure

. Forensic investigators said compromised credentials belonging to a Safe developer allowed the attackers to inject malicious code into its cloud infrastructure. The FBI

attributed

the theft to North Korea on Feb. 26, 2025.

The lawsuit shows that Bybit is seeking the return of the stolen assets, approximately $1.5 billion in compensatory damages, punitive damages and treble damages under the US Racketeer Influenced and Corrupt Organizations Act.

Magazine:

10 weirdest things ever tokenized... including farts

Subscribe to daily byte-sized crypto news from Cointelegraph

Subscribe

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s

Editorial Policy

and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

Hackers

Hacks

Bybit

United States

Law

Scams & Cybercrime

More on the subject

Coldcard exploit pushes July losses to $247M as second-worst month of 2026

20 hours ago

Zoltan Vardai

Crypto wrench attacks steal more than $30M so far in 2026: Chainalysis

Aug 6, 2026

Ezra Reguerra

Coldcard hackers transfer 64 BTC and 200 ETH to cryptocurrency mixers

Aug 6, 2026

Zoltan Vardai

Coldcard exploit pushes July losses to $247M as second-worst month of 2026

20 hours ago

Zoltan Vardai

Crypto wrench attacks steal more than $30M so far in 2026: Chainalysis

Aug 6, 2026

Ezra Reguerra

Coldcard hackers transfer 64 BTC and 200 ETH to cryptocurrency mixers

Aug 6, 2026

Zoltan Vardai