Bitcoin Trading Venue Bybit Wins Expedited Discovery in $1.5B Crypto Hack Case

Crypto News

A U.S. federal court has granted Bybit, a major venue for Bitcoin (BTC) and broader altcoin trading, expedited discovery in its civil action to trace assets stolen in a $1.5 billion hack tied to North Korea. The order, reflected in court records unsealed this week, gives the exchange an early litigation tool to compel account data from third parties before a full trial. Bybit filed the complaint under seal on June 18, naming the Democratic People’s Republic of Korea, the Reconnaissance General Bureau, Lazarus Group and 20 John Doe defendants. The next day, the court approved the accelerated discovery request, allowing the company to identify alleged intermediaries that moved the funds and to seek records from platforms that may hold relevant accounts. In the filing, Bybit alleged that a portion of the traceable assets reached exchanges that operate in the United States or maintain infrastructure there. The exchange requested identities of account holders, balances and transaction histories. It also told the court that some platforms indicated they would cooperate once presented with a judicial order. The procedural win matters because the window for recovery narrows quickly in large thefts, especially when funds move through mixers, cross-chain bridges and over-the-counter desks. Bybit’s request framed expedited discovery as a way to prevent further dissipation while the case remains at an early stage. The mechanism is not a final judgment on liability; it is a pretrial authorization to gather evidence quickly from custodians, exchanges and other third parties that may hold clues to the route taken by the stolen assets. The court also kept some exhibits sealed, so the record does not yet reveal every intermediary or institution involved. For Bitcoin market participants, the significance is practical: custody breaches at a large crypto venue can create legal claims that reach into U.S.-based account providers, and the speed of subpoenas or discovery orders may determine whether any remaining funds can be preserved.

The unsealed docket adds a clearer picture of how much of the loss remains reachable. As of the June 18 filing, Bybit said 90.2% of the funds were no longer traceable, having passed through mixers, cross-chain bridges and OTC dealers. The remaining 9.8% was tied to identifiable wallets. Within that slice, 5.3% of the total loss, roughly $75.5 million, had been frozen or recovered. Those figures show how quickly the recoverable share can shrink. More than a year earlier, Bybit Chief Executive Officer Ben Zhou had said 68.57% of the funds remained traceable, a figure that now looks far more optimistic. The timeline in the records also shows parallel protective measures. The court issued a temporary restraining order on June 19, blocking unnamed defendants from moving specific assets that could still be followed. The order was renewed on July 16, and the court partially granted a preliminary injunction on July 30, while some exhibits remained sealed. The underlying breach dates to Feb. 21, 2025, when attackers compromised Safe Wallet infrastructure. Forensic findings described in the filing indicate that stolen credentials tied to a Safe developer allowed malicious code to be injected into cloud systems. The FBI’s Feb. 26, 2025 attribution tied the theft to North Korea. Bybit’s claims are broad: return of the stolen property, roughly $1.5 billion in compensatory relief, punitive relief and triple damages under RICO, the U.S. racketeering law. The complaint’s use of expedited discovery is aimed at the narrow window before funds are further fragmented into smaller outputs, swapped across networks, or withdrawn through non-cooperative jurisdictions. That is especially relevant where account-holder information sits with intermediaries subject to U.S. jurisdiction, because a court order can convert an anonymous wallet label into a usable legal lead. For the wider crypto industry, the numbers illustrate a harsh operational reality. Even when a victim obtains legal authority, the structure of decentralized transfer paths can outrun the courts.

COINOTAG’s reading of the primary record centers on the docket in Bybit Technology Ltd. v. Democratic People’s Republic of Korea. The court’s June 19 order granted expedited discovery and entered a temporary restraining order against unnamed defendants, later renewed and followed by a partial preliminary injunction. That posture shows the case is in early evidence-gathering, not final liability. The practical lesson spans Bitcoin, every altcoin, algorithmic stablecoins, experimental AI crypto wallet designs and even airdrop accounting: when assets move quickly, court speed matters, but on-chain obfuscation still decides recoverability for exchange risk teams and custodians.