Bybit has secured U.S. court orders to trace and freeze assets tied to the roughly $1.5 billion hack of its exchange in 2025, escalating a landmark civil recovery effort against North Korea and the Lazarus Group.
What happened in the Bybit hack case
Bybit said on August 7, 2026 that it filed a civil lawsuit in the U.S. District Court for the District of Columbia against North Korea, its Reconnaissance General Bureau, and the Lazarus Group, the exchange said in a press statement. For related coverage, see Bybit Secures Austrian EMI License for EU Payments.
The FBI said on February 26, 2025 that North Korea was responsible for the theft of approximately $1.5 billion in virtual assets from Bybit on or about February 21, 2025, activity the bureau labeled TraderTraitor. For related coverage, see Artificial Intelligence Summit –Malaysia 2026.
The move into the U.S. legal system turns a security incident into one of the largest crypto asset-recovery cases yet, building on Bybit’s earlier decision to sue North Korea and Lazarus over the theft.
What the U.S. court orders allow Bybit to do
Court records summarized by Cointelegraph say Bybit filed the lawsuit under seal on June 18, 2026, and the court granted expedited discovery the following day, letting the exchange trace the movement of allegedly stolen funds across platforms.
The same court reporting says Bybit obtained a temporary restraining order on June 19, 2026, saw it renewed on July 16, 2026, and won a partial preliminary injunction on July 30, 2026, freezing identified assets held by unidentified John Doe defendants while the case continues.
Those legal tools matter in cross-platform crypto cases because stolen funds move quickly through many venues. Expedited discovery compels exchanges and custodians to reveal wallet links, while a freeze order preserves assets that would otherwise be withdrawn during a lengthy recovery fight. The exchange has framed the effort as a bid to trace funds from the North Korea-linked hack.
Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable.
— Ben Zhou, Bybit CEO, in Bybit’s statement
Why this ruling matters for crypto security and enforcement
A court-backed freeze in a case this size signals stronger legal coordination around digital-asset recovery, running in parallel with criminal investigations that the FBI opened after its TraderTraitor attribution.
The recovery numbers, however, show the limits. Bybit said approximately US$48.4 million has been recovered and over US$30.5 million has been frozen across more than 28 exchanges and custodians, a combined figure that remains a fraction of the total loss.
Court filings underline the difficulty: as of the June 18, 2026 filing, 90.2% of the stolen assets had become untraceable, 9.8% remained tied to identifiable wallets, and 5.3% of the total, about $75.5 million, had been frozen or recovered.
That split illustrates why recovery in billion-dollar crypto hacks is so difficult, even when courts back the effort: most funds are laundered before legal orders arrive, and a freeze cannot restore assets already washed through mixers and untraceable wallets.
For exchanges, the case sets a template for pairing incident response with civil litigation, and it puts renewed scrutiny on compliance and transaction monitoring at the venues that stolen funds pass through. Recovery is not guaranteed, but the sealed-case timeline shows how quickly civil remedies can be deployed after a major breach.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
