In a significant legal victory, Bybit has obtained a U.S. federal court order allowing expedited discovery to trace assets linked to the $1.5 billion Lazarus Group hack. The ruling empowers the exchange to identify account holders, balances, and transaction histories from platforms operating in the United States.
Court documents reveal that the order, issued in the District Court for the District of Columbia, permits Bybit to request detailed records before any changes occur. The lawsuit, filed under seal on June 18, targets North Korea’s Reconnaissance General Bureau, the Lazarus Group, and 20 unnamed defendants. The court approved expedited discovery the following day, while keeping certain exhibits sealed.
To preserve identifiable assets, a temporary restraining order was issued on June 19, barring defendants from transferring specific funds. This order was renewed on July 16, and a partial preliminary injunction was granted on July 30. Bybit claims these legal steps are critical to freeze assets while the case proceeds.
Despite these efforts, Bybit informed the court that 90.2% of the stolen assets had become untraceable by June 18. The funds were allegedly laundered through mixers, cross-chain bridges, and over-the-counter dealers, obscuring the transaction trail. Nonetheless, 9.8% of the total remains traceable, including $75.5 million that has either been frozen or returned to recovery channels.
The February attack drained over 400,000 ETH and staked ETH from the Dubai-based exchange. Investigators linked the breach to compromised Safe Wallet infrastructure and developer credentials. The FBI officially attributed the theft to North Korea on February 26, 2025, under the operation name TraderTraitor.
Bybit’s lawsuit seeks the return of stolen assets and $1.5 billion in compensatory damages, plus punitive and treble damages under the U.S. Racketeer Influenced and Corrupt Organizations Act. CEO Ben Zhou emphasized the company’s priority is to “protect our users first” and recover available funds, while holding those responsible accountable. Bybit plans to pursue further judicial relief and share blockchain records with investigators and regulators.
North Korea has not publicly responded, and the defendants have yet to present a defense in unsealed filings. Parts of the proceedings remain confidential.