US Court Grants Bybit Expedited Discovery to Recover Stolen Assets from $1.5B North Korea Breach
A federal judge has authorized cryptocurrency exchange Bybit to pursue an accelerated discovery process to trace and recover stolen assets from a February 2025 breach attributed to North Korea, enabling access to account information from US-based platforms.
Court Approves Bybit’s Legal Strategy for Asset Recovery
A federal judge has backed cryptocurrency exchange Bybit in its pursuit to recover assets stolen during a major February 2025 breach. Court documents made public Thursday reveal that the judge approved an expedited discovery process that Bybit sought when filing its initial lawsuit under seal in mid-June. The court authorized this accelerated procedure just one day after the filing was submitted, enabling Bybit to obtain critical information from cryptocurrency platforms operating or maintaining infrastructure within the United States.
The expedited discovery authorization permits Bybit to request specific data from these platforms, including account holder identities, account balances, and transaction histories. This legal approach provides a more practical route for tracking and potentially retrieving a portion of the stolen funds compared to attempting enforcement against North Korea directly. Alongside this discovery grant, Bybit secured a temporary restraining order preventing defendants from moving traceable assets. The court renewed this protective order in July and partially granted Bybit’s preliminary injunction request later that month.
The Breach and Limited Recovery Prospects
The February 2025 attack resulted in the theft of approximately $1.5 billion in cryptocurrency from Bybit. Attackers exploited compromised credentials belonging to a Safe Wallet developer, which allowed them to inject malicious code into Safe’s cloud infrastructure. According to the FBI, as reported by Cointelegraph, North Korea was responsible for the attack. Bybit’s legal filing names North Korea, its Reconnaissance General Bureau, the Lazarus Group, and 20 additional unidentified defendants.
Recovery remains challenging. As of the mid-June filing date, forensic analysis showed that 90.2% of the stolen funds had become untraceable after passing through mixing services, cross-chain bridges, and informal trading channels. Only 9.8% remained potentially recoverable, with approximately $75.5 million already frozen or recovered. This represents a sharp decline from earlier tracking efforts, when Bybit’s leadership indicated that roughly 68.57% of the funds could be traced more than a year prior.
Legal Precedent and Market Implications
Bybit is pursuing the return of the stolen cryptocurrency alongside substantial damages claims, including compensatory damages, punitive damages, and treble damages under federal racketeering statutes. Several court filings and supporting exhibits remain sealed as the litigation progresses.
This case establishes an important precedent for the cryptocurrency industry. By pursuing legal remedies through the US court system, Bybit has demonstrated that centralized jurisdictions can effectively facilitate the tracing and recovery of stolen digital assets from major security breaches. The court’s approval of expedited discovery in a cryptocurrency theft case creates a procedural framework that could guide how similar large-scale incidents are handled in the future, ultimately strengthening the legal protections available to cryptocurrency platforms and their users.
Source: FBI, via Cointelegraph. Not financial advice.