A US court has granted Bybit expedited discovery in its civil case against North Korea over the February 2025 hack that drained $1.5 billion from the exchange, according to filings unsealed on August 8, 2026. The order lets Bybit compel US-based platforms to hand over account-holder identities, balances and transaction histories tied to addresses linked to the theft.
The lawsuit, filed June 18, 2026 in the case Bybit Technology Limited v. Democratic People's Republic of Korea, names North Korea itself, its Reconnaissance General Bureau, the Lazarus Group and 20 unidentified defendants. According to Cointelegraph, the court granted the expedited discovery request the day after filing and has since renewed a temporary restraining order and partially granted a preliminary injunction.
Most of the stolen funds are already gone
The numbers underline why Bybit is leaning on the courts rather than blockchain tracing alone. As of the June 18 filing, 90.2% of the stolen funds had passed through mixers, cross-chain bridges and OTC desks and were effectively untraceable. Of the remaining 9.8%, only 5.3% — roughly $75.5 million — had been frozen or recovered. That marks a sharp deterioration from Bybit CEO Ben Zhou's estimate just over a year earlier that 68.57% of the funds remained traceable, illustrating how quickly laundering pathways erode recovery odds once stolen crypto starts moving.
Certain platforms had indicated they would cooperate after receiving a court order.
Related: Treasury Sanctions Two Exchanges Over Iran Crypto Laundering Scheme
Seeking treble damages under RICO
Bybit is pursuing the return of the stolen assets alongside roughly $1.5 billion in compensatory damages, punitive damages, and treble damages under the Racketeer Influenced and Corrupt Organizations Act. The FBI formally attributed the February 21, 2025 theft to North Korea five days after it happened, tracing the intrusion to compromised credentials of a Safe developer that let attackers inject malicious code into Safe Wallet's cloud infrastructure.
Part of a widening pattern
The Bybit case sits inside a much larger trend: North Korea–linked actors stole an estimated $2.02 billion in crypto during 2025 alone, a 51% year-on-year increase that pushed the regime's all-time cumulative haul to roughly $6.75 billion. Recovery efforts elsewhere have fared little better — a bounty program tied to the Bybit hack has clawed back less than three cents for every dollar stolen. Expedited discovery gives Bybit a legal lever US exchanges and custodians can't easily ignore, but with the vast majority of the $1.5 billion already laundered beyond reach, the case is likely to be a multi-year fight over a shrinking pool of recoverable funds.
