Bybit has secured U.S. court backing in its effort to trace and freeze assets tied to a $1.5 billion North Korea-linked hack, moving the exchange's asset-recovery campaign from private investigation into a formal legal process.
What the U.S. court backing means for Bybit's recovery effort
The case centers on tracing and recovering funds stolen in the breach, with Bybit turning to the U.S. court system to pursue the money rather than relying on off-chain negotiation. The exchange said it sued North Korea and the Lazarus Group and secured a preliminary injunction freezing stolen assets, according to a Bybit press statement. For related coverage, see Bybit Launches New Daily Treasure Hunt Season Featuring Football Match Tickets and XAUT Rewards.
The backing reflects a procedural step, not a final recovery outcome. A preliminary injunction and court support for tracing are early mechanisms; they position Bybit to follow and lock down assets rather than confirm that the $1.5 billion has been returned. For related coverage, see Bybit Ranks No. 2 in Open Interest Among Major Crypto Exchanges, Leads CEXs in OI-to-Volume Ratio.
Filings in the matter have been docketed in federal court, as reflected in the court record for Bybit Technology Limited v. Democratic People's Republic of Korea et al. For related coverage, see Bybit Announces Early Bird Ticket Access for Tomorrowland Brasil 2027 for Bybit Cardholders.
How the legal push targets stolen funds and alleged North Korea links
The lawsuit names North Korea and the Lazarus Group and pairs the tracing effort with an injunction intended to keep identified assets from moving. Tracing, freezing, and attribution are distinct steps: following funds on-chain, obtaining orders to hold them, and formally tying them to a named actor.
The North Korea framing aligns with law-enforcement attribution. U.S. authorities publicly linked the Bybit breach to North Korean actors in a public service announcement from the FBI's IC3.
Supporting documents in the docket set out the relief sought, as detailed in a filing in the case. North Korea-linked attribution has surfaced in other incidents as well, including when a Ledger executive tied a separate protocol hack to North Korea.
Why this case matters for crypto asset recovery
The action is a test of whether courts and exchanges can coordinate to trace and freeze stolen crypto across borders. Bybit is using formal legal tools to pursue funds that have already been attributed to a state-linked group by U.S. law enforcement.
The relevant lens here is legal recovery, not token price impact. The case is about enforcement mechanics: tracing on-chain movement, holding assets under injunction, and pressing attribution claims in court. Bybit has separately drawn regulatory attention this year, including when Singapore's MAS added the exchange to its investor alert list.
What matters next is whether the tracing and freezing steps hold up and lead to enforcement, rather than the headline figure itself.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.