A United States court has backed Bybit's attempt to trace funds tied to a $1.5 billion hack attributed to North Korea, granting the cryptocurrency exchange judicial support for its recovery effort. The February 2025 breach of Bybit's Ethereum cold wallet ranks among the largest cryptocurrency thefts on record, and the court backing does not, however, establish that any stolen assets have been recovered to date.

In a Bybit announcement, the exchange stated that it has sued North Korea and the Lazarus Group and obtained a preliminary injunction freezing stolen assets. The Lazarus Group, a cybercriminal unit linked to North Korea's Reconnaissance General Bureau, has been identified by US law enforcement and blockchain analytics firms including Chainalysis as responsible for a substantial share of stolen digital assets in recent years, with proceeds reportedly used to circumvent international sanctions and fund state weapons programs. The company described the court order as a legal mechanism designed to support tracing and preservation efforts while the case proceeds.

Scope of the Legal Action

Independent reporting by CoinDesk in its Aug. 7, 2026 report corroborates the core outline provided by Bybit. According to CoinDesk, the exchange sued North Korea and the Lazarus Group over the $1.5 billion hack and secured an asset freeze. The convergence between Bybit's company statement and a named third-party report represents the strongest available confirmation at this stage.

Bybit's own description of the recovery effort emphasizes process over outcome. The approach involves identifying where the funds were moved, petitioning the court to help preserve them, and refraining from overstating the recovery status before the evidentiary record supports such claims. Tracing stolen cryptocurrency typically requires following funds as they pass through mixers, cross-chain bridges, and multiple wallets—techniques that blockchain analytics firms have documented North Korean operators using to complicate recovery.

Official Sources and Limitations

The case brief also references a 2025 IC3 public service announcement as its primary official source, though no specific findings from that notice were included in the available documentation.

Within the limited record currently available, the case operates within both a law-enforcement framework and a private-company recovery effort. The use of civil litigation by exchanges to complement criminal investigations reflects a pattern that has grown across the digital asset sector, as victims seek court orders to freeze and recover laundered funds more quickly than criminal proceedings typically allow. The brief does not, however, substantiate broader claims beyond the court-backed tracing authorization.

Significance and Outstanding Questions

The ruling is notable because it connects a major cryptocurrency exchange, a US court, and allegations against North Korea and the Lazarus Group within a single documented recovery effort. It represents a legal extension of a recurring challenge in the digital asset sector: how platforms respond following a major theft.

Equally important is what the brief does not establish. It provides no recovered-funds total, no final judgment, and no detailed court filings. The publishable conclusion is therefore limited to the legal opening described in Bybit's statement and echoed in CoinDesk's report: the court has authorized Bybit to follow the money, while the question of ultimate recovery remains unresolved.