Bybit Wins US Court Order to Trace $1.5B North Korea Hack Funds

Bybit Secures Court-Ordered Discovery in $1.5B Hack Probe

Bybit has obtained a US court order permitting expedited discovery to trace funds stolen in the massive $1.5 billion hack attributed to North Korean actors. The ruling allows the exchange to request account identities, balances, and transaction histories from financial platforms operating within US jurisdiction, a critical step in following the money trail.

The hack, one of the largest in crypto history, targeted Bybit's Ethereum cold wallet in February 2025. North Korea's Lazarus Group is widely believed to be behind the attack, which drained over 400,000 ETH and related tokens. The court's approval of expedited discovery underscores the seriousness of the case and the urgency to recover assets before they are laundered further.

Bybit has been proactive in offering a bounty for information leading to the freezing of stolen funds, and this legal maneuver adds a formal mechanism to compel cooperation from exchanges and financial intermediaries.

What Drove the Court's Decision and Its Implications

Expedited Discovery: A Legal Fast-Track for Asset Tracing

Expedited discovery is an exceptional legal tool that allows parties to obtain evidence quickly, often before a full lawsuit is filed. In this case, the court recognized the urgent need to prevent the dissipation of stolen assets. Bybit can now issue subpoenas to exchanges and payment processors with US operations, demanding records that could reveal where the funds have moved.

This order is a significant precedent for crypto exchanges seeking legal recourse against sophisticated cybercriminals. It highlights how courts are adapting traditional legal mechanisms to the fast-paced, cross-border nature of digital assets.

North Korea's Laundering Playbook and the Crypto Response

North Korean hackers have historically laundered stolen crypto through mixers, cross-chain bridges, and over-the-counter brokers. The Lazarus Group's methods have evolved, but each step leaves traces. Bybit's discovery request aims to pierce through these layers by obtaining data from platforms that may have unknowingly processed the funds.

The crypto industry has responded with increased cooperation—exchanges now share threat intelligence and freeze suspicious accounts. This court order could further incentivize platforms to implement robust compliance measures to avoid legal entanglements.

Key Levels to Watch: On-Chain Clues and Exchange Compliance

For traders, the movement of these stolen funds is a real-time indicator of market sentiment. Large transfers to exchanges often precede sell pressure, which could impact ETH and BTC prices. Monitoring on-chain data—such as whale alerts and exchange inflows—can provide early signals.

Additionally, the court's decision may prompt other exchanges to tighten their know-your-customer (KYC) and anti-money laundering (AML) protocols. This could lead to increased friction for users, but also greater security and legitimacy for the crypto market as a whole.

What This Means for Traders: Risk, Compliance, and Opportunity

This development underscores the growing intersection of crypto and legal frameworks. Traders should recognize that regulatory actions can have swift market impacts. When stolen funds are traced and frozen, it reduces the overhang of potential sell pressure, which can be bullish for the affected assets.

However, compliance crackdowns can also introduce short-term volatility. Exchanges may temporarily halt withdrawals or delay transactions to comply with subpoenas. Traders should stay informed about such operational risks, especially when trading on platforms with US exposure.

From an educational standpoint, this case illustrates the importance of on-chain analysis and security practices. Understanding how to track transactions and interpret technical indicators can help traders navigate market reactions to such events. Engaging with signal rooms can also provide real-time insights from the community.