US court backs Bybit trace funds of $1.5B North Korea hack
A US federal judge granted Bybit expedited discovery in its case to trace funds from a $1.5B North Korea-linked hack. Bybit filed the lawsuit under seal on June 18 against North Korea’s Reconnaissance General Bureau, the Lazarus Group, and 20 unidentified defendants. The court approved expedited discovery on June 19, allowing Bybit to seek account-holder identities, balances, and transaction histories from platforms with US operations to identify intermediaries and pursue traceable portions of the stolen assets.
Bybit obtained a temporary restraining order on June 19 blocking the unidentified defendants from transferring certain traceable assets. The order was renewed on July 16, and the court partially granted a preliminary injunction on July 30 (some exhibits remain sealed).
Key figures in the complaint: Bybit said 90.2% of the stolen funds became untraceable after passing through mixers, cross-chain bridges, and OTC dealers. The remaining 9.8% was traceable to identifiable wallets, including 5.3% (about $75.5 million) that were frozen or recovered. Bybit’s filing also seeks return of the theft, claiming compensatory, punitive, and treble damages under the US RICO (Racketeer Influenced and Corrupt Organizations Act).
The hack occurred on Feb. 21, 2025, after attackers compromised Safe Wallet’s infrastructure, using credentials belonging to a Safe developer to inject malicious code into the cloud environment. The FBI attributed the theft to North Korea on Feb. 26, 2025.
Overall, this Bybit trace funds ruling improves the odds of pinpointing on-chain routes, but near-term effects on major token prices are likely limited. Bybit trace funds efforts remain a legal and evidence-driven process rather than an immediate asset-distribution catalyst.
Neutral
This is primarily a legal/evidence development: a US court granted Bybit expedited discovery, which should improve the company’s ability to trace stolen North Korea-linked funds and identify intermediaries. In crypto markets, that can support longer-term compliance and deterrence narratives, but it usually does not immediately change token supply/demand.
In the short term, traders may watch for exchange- or custody-related sentiment shifts around Bybit, yet the article’s key numbers (90.2% untraceable; 5.3% ~$75.5M frozen/recovered) imply only a fraction is currently actionable. That limits any direct “instant liquidation” or “instant repayment” effect on liquid market prices.
By analogy, when courts or regulators release findings that enable asset tracing (or freeze revelations), markets often react mainly to perceived credibility/risk management of exchanges rather than to immediate macro effects. Unless additional follow-up orders result in large, confirmed recoveries reaching the market, the price impact is likely muted. Hence the expected market impact is neutral rather than bullish/bearish.