Crypto Exchanges

Story: Bybit Gets U.S. Court Backing to Chase $1.5B Lazarus Group Theft

By Pankaj K

1 / 15

What the Court Actually Authorized. The expedited discovery order is pretty broad. Bybit can now demand account identities, balances,…

2 / 15

The Traceability Problem. Here's the hard part. As of when Bybit filed in June, 90.

3 / 15

What Comes Next. The partial preliminary injunction from July 30 keeps some pressure on, but the sealed records…

4 / 15

A U.S. federal court handed Bybit a significant legal weapon last month. The court approved expedited discovery, letting the crypto exchange dig into account records and…

5 / 15

The hack hit on February 21, 2025. North Korean attackers got into Safe Wallet's cloud infrastructure using compromised credentials from a developer, then injected malicious code…

6 / 15

The expedited discovery order is pretty broad. Bybit can now demand account identities, balances, and full transaction histories from exchanges and platforms that have U.S.

7 / 15

The temporary restraining order from June 19 was renewed on July 16. Then on July 30, a partial preliminary injunction came through — though some of those court records are still…

8 / 15

The legal theory behind the lawsuit isn't just standard civil recovery. Bybit is going after compensatory damages of $1.

9 / 15

Here's the hard part. As of when Bybit filed in June, 90.2% of the stolen funds had already gone dark — passed through mixers, cross-chain bridges, and over-the-counter dealers…

10 / 15

More context: Senate Clarity Act Vote Pushed Past August Recess by Thune

11 / 15

And that 9.8% is actually a sharp drop from where things stood earlier. Bybit CEO Ben Zhou said that over a year ago, 68.57% of the funds were still traceable.

12 / 15

The Lazarus Group has pulled off this kind of operation before. They're not amateurs. Forensic investigators found that the attack on Safe Wallet's infrastructure was technically…

13 / 15

Bybit's situation isn't unique in crypto. Exchanges have faced state-sponsored attacks for years, and the recovery rate on stolen funds has historically been low.

14 / 15

The partial preliminary injunction from July 30 keeps some pressure on, but the sealed records make it hard to know exactly what's been locked down.

15 / 15

More context: Lummis Pushes CLARITY Act Past 300-Page Revision With September Vote Now the Target

The Currency Analytics

Want the full story?