A US court granted Bybit expedited discovery in its pursuit of funds stolen during North Korea's $1.5 billion hack. The ruling permits the exchange to obtain account identities, balances, and transaction histories from platforms operating in the United States.

Bybit's legal move targets the recovery of assets traced to the massive theft attributed to North Korean threat actors. The expedited discovery process accelerates the exchange's ability to subpoena information from other platforms with US jurisdiction, bypassing slower standard procedures.

This decision reflects growing judicial willingness to assist crypto exchanges in tracing and recovering stolen digital assets. Courts now recognize the necessity of rapid information sharing when national security issues intersect with financial crimes. North Korea's history of large-scale crypto theft makes these enforcement actions especially high-priority.

The ruling requires platforms with US operations to comply with document requests faster than typical civil litigation timelines. This includes revealing which accounts received or held portions of the stolen funds, their balances at specific dates, and complete transaction records. Such transparency can establish money trails and identify bad actors attempting to launder hacked assets.

Bybit's success here sets precedent for other exchanges pursuing similar recovery efforts. As crypto theft continues to evolve, with sophisticated actors using multiple platforms to obscure fund movements, access to cross-platform transaction data becomes essential. The court's decision acknowledges this reality.

North Korea's cyber operations have stolen an estimated $14 billion in crypto since 2017, making asset recovery a persistent challenge for the international crypto community. Lazarus Group and affiliated units target exchanges, protocols, and bridges with increasing sophistication. Each successful recovery effort raises costs for attackers and deters future attempts.

Bybit's win doesn't guarantee recovery of the full amount. Assets may sit in wallets, be converted to other cryptocurrencies, or remain deliberately fragmented across dormant accounts. However, obtaining platform data dramatically