What happened
A US court on Friday granted Bybit's motion for expedited discovery in its civil action to trace and recover funds drained in the February 2026 exploit, according to Cointelegraph's report citing the filing. Expedited discovery is a procedural tool that lets a plaintiff skip the usual pre-discovery waiting period and immediately subpoena third parties. In Bybit's case, that means custodians, exchanges, payment processors, and OTC desks with US operations can be compelled to hand over KYC records, wallet-to-account mappings, and transaction histories connected to addresses already tagged in the stolen fund trail.
The exchange has been running a parallel on-chain tracing effort since day one, publishing tagged addresses and coordinating with blockchain forensics firms. The court order gives that effort legal teeth on US soil. It doesn't freeze funds by itself.
It tells US-facing platforms they can't stonewall Bybit's lawyers with a boilerplate privacy refusal.
Why it matters
The February hack was the largest single crypto theft on record when it happened, and US and allied agencies attributed it to North Korea's Lazarus-linked operators within days. Six months on, most of the stolen ETH has been laundered through cross-chain bridges, mixers, and OTC brokers. Getting an expedited discovery order matters because it flips the burden.
Instead of Bybit asking nicely, US platforms now have to answer under court order or explain to a federal judge why they can't. That's the single biggest lever a hacked exchange has against sanctioned actors laundering through Western infrastructure. It also puts pressure on any US-touching venue that processed flagged funds knowingly or through weak controls.