US federal court records unsealed on Thursday show that a judge backed cryptocurrency exchange Bybit’s effort to trace assets stolen in the $1.5 billion hack linked to North Korea. The court granted expedited discovery, allowing Bybit to seek information from platforms with US operations or infrastructure. Bybit filed the lawsuit under seal on June 18 against North Korea, its Reconnaissance General Bureau, the Lazarus Group and 20 unidentified defendants. The court granted expedited discovery on June 19, giving the exchange a practical route to identify alleged intermediaries and pursue the small portion of stolen assets that remains traceable. Bybit alleged that some traceable assets reached exchanges operating or maintaining infrastructure in the US. It sought account-holder identities, balances and transaction histories, saying some platforms had indicated that they would cooperate after receiving a court order. The hack occurred on February 21, 2025, after attackers compromised Safe Wallet’s infrastructure. Forensic investigators said compromised credentials belonging to a Safe developer allowed malicious code to be injected into its cloud infrastructure. The FBI attributed the theft to North Korea on February 26, 2025. Bybit said some assets became untraceable after passing through mixers, cross-chain bridges and over-the-counter dealers. Other assets were traced to identifiable wallets, with about $75.5 million frozen or recovered. The court also issued a temporary restraining order on June 19 preventing the unidentified defendants from transferring certain traceable assets. It renewed that order on July 16 and partially granted Bybit’s request for a preliminary injunction on July 30. The lawsuit seeks the return of the stolen assets, approximately $1.5 billion in compensatory damages, punitive damages and treble damages under the US RICO Act. For Somalis using international exchanges, the case illustrates how recovering digital assets can depend on court orders and cooperation among platforms operating across borders.