Bybit Gains U.S. Court Support to Trace $1.5B Hack Funds

A federal judge in Washington granted expedited discovery and partially approved a preliminary injunction in Bybit's lawsuit to recover about $1.5 billion in assets stolen in the February 2025 hack. The orders allow the exchange to seek account records from platforms with U.S. operations and to freeze certain traceable funds while the case proceeds.

Bybit filed the complaint under seal on June 18 in the U.S. District Court for the District of Columbia. The defendants include North Korea, its Reconnaissance General Bureau, the Lazarus Group, and 20 unidentified John Doe entities. Judge John D. Bates granted expedited discovery the next day and issued a temporary restraining order to stop movement of some assets. The TRO was renewed on July 16. On July 30, Bates granted the preliminary injunction in part, preserving identified assets. Bybit said the court found that "Bybit has demonstrated a likelihood of success on the merits." That finding is interim, not a final ruling.

In its Aug. 7 update, Bybit said it has recovered roughly $48.4 million of the stolen funds. Another $30.5 million remains frozen across more than 28 exchanges and custodians, though that money has not yet been returned. Combined, about $78.9 million falls into the recovered or frozen category.

The exchange's June filing painted a more difficult picture. Ninety point two percent of the stolen assets had become untraceable after moving through mixers, cross-chain bridges and over-the-counter dealers. Only 9.8 percent remained connected to identifiable wallets at that point. About 5.3 percent of the original theft, roughly $75.5 million, had been frozen or recovered by then.

The latest separation of recovered and frozen amounts shows the gap widening. In March, CEO Ben Zhou said 88.87% of stolen funds could still be traced, 7.59% had gone dark and 3.54% had been frozen. The June filing reflected how laundering continued to obscure the trail.

The FBI attributed the attack to North Korea on Feb. 26, five days after the theft. The agency tracks the activity as "TraderTraitor." It said the attackers converted some stolen assets into Bitcoin and other cryptocurrencies, dispersing them across thousands of addresses on multiple blockchains. The FBI urged exchanges and service providers to block transactions linked to addresses it identified. Bybit says its civil lawsuit remains separate from U.S. criminal investigations and that it continues sharing intelligence with the FBI.