Bybit Wins U.S. Court Backing on $1.5B Hack, but 90% of Stolen Funds Are Already Gone

The ruling helps Bybit move faster, but the recoverable pool is already small

A federal judge granted expedited discovery, allowing Bybit to move faster than a normal lawsuit timeline and seek account identities, balances, and transaction histories from services that handled the stolen funds. That is a meaningful procedural win because crypto recovery usually depends on two things: following the flow of funds and securing a legal hook to press the intermediaries.

The harder problem is the state of the funds themselves. Bybit said 90.2% of the stolen assets had become untraceable after moving through mixers, cross-chain bridges, and over-the-counter dealers. It also said only 9.8% had been traced to identifiable wallets, with about $75.5 million frozen or recovered. So the main question is no longer whether the court backed Bybit; it is whether enough funds still sit in reachable venues to make recovery meaningful.

Why discovery matters more than on-chain tracing at this point

The practical value of the order is not the headline ruling itself. It is what Bybit can now do next: press the people and platforms between the last visible trail and the cash-out. The complaint named 20 unidentified defendants alongside the state-linked actors, and the court allowed Bybit to pursue discovery through expedited discovery. That shifts part of the fight from following on-chain hops to gathering records from intermediaries.

Intermediaries matter once the trail gets noisy

Blockchain transparency has limits once stolen funds move through enough obfuscation layers. That makes the next reachable service more important than the long trail behind it. Bybit is targeting those choke points because some traceable proceeds may still sit on platforms that can respond to legal process. Court records say some traceable assets reached exchanges operating or maintaining infrastructure in the US, and certain platforms had indicated they would cooperate after receiving a court order.

The injunction preserves assets; it does not return them

Bybit also obtained injunctive relief to slow further movement of the remaining traceable funds. The court issued a preliminary injunction after earlier temporary restraining order relief. But that is a preservation step, not a full recovery. The size of the remaining pool is still limited, which is why the next disclosures matter more than the initial headline.

What matters now is whether reachable funds can still be tied up

The key watchpoint is straightforward: the next updates should show whether discovery is identifying reachable balances at cooperative venues, or merely mapping funds that have already moved deeper into laundering infrastructure.

Three factors matter most now: - The size of the remaining pool that has not disappeared into enough obfuscation layers. - Whether discovery produces useful information from services along that chain, including account identities, balances, and transaction histories. - Whether courts continue to support preservation measures such as the preliminary injunction.

A clearer negative signal would be discovery showing that the remaining traceable assets are too small or too deeply embedded to recover in any practical sense. In that case, the legal victory would matter more for process and deterrence than for actual fund recovery.