Bybit Wins U.S. Court Help Tracing $1.5B Hack Funds-But 90% Still Vanished

U.S. court support changes Bybit's tracing path, not the recovery total

This is a procedural win, not a recovery headline. Bybit moved from broad attribution to a court-backed tracing playbook after it brought the case under seal on June 18 and received expedited discovery the following day. That matters because the ruling can sharpen the search while the trail is still fresh, not because it instantly returns lost capital.

The key change is friction. Rather than relying on public attribution alone, Bybit now has faster legal authority to press into parts of the fund flow that may still touch responsive intermediaries. The court has already backed that effort with a temporary restraining order on June 19 and a preliminary injunction on July 30. For custodians and exchanges, that raises the chance that held balances could be targeted for inquiry or restraint.

The upside is still limited. Bybit has said 90.2% of the stolen assets had become untraceable after passing through mixers, cross-chain bridges, and OTC dealers. Even so, a court order can make the remaining traceable pockets easier to identify and isolate.

Why expedited discovery matters more than another attribution headline

Expedited discovery lets Bybit skip the usual months-long wait and seek account identities, balances and transaction histories from platforms with U.S. operations. That shifts the pressure point from anonymous wallets to intermediaries that may have to respond to U.S. process.

How the pressure chain works

Bybit alleged that some funds reached exchanges operating in the United States or maintaining infrastructure there, and that some providers had indicated they would cooperate once presented with a court order. If that holds, each intermediary becomes a potential bottleneck. A compliance team does not need to admit wrongdoing to react to a court order; it may simply have to produce account identities, balances, and transaction histories or explain why certain assets are already frozen or segregated.

That matters because the recoverable slice appears small. Bybit said it has recovered $48.4 million so far, while 90.2% of the stolen assets had become untraceable. The case does not require recovering the whole pool at once; it requires finding the narrow links still connected to traceable, compellable infrastructure.

What would make the setup work

If Bybit can connect wallet clusters to real account holders, the attackers lose anonymity faster than they can fully launder the funds. The court has already given Bybit tools to target parts of that flow, including a temporary restraining order and a preliminary injunction. The practical upside is straightforward: intermediaries may freeze contested balances, refuse to process tainted deposits, or produce records that reveal the next hop.

What would limit the impact

The simpler counterargument is that the trail may already be mostly dead end. The stolen funds moved through mixers, cross-chain bridges, and OTC desks, and many court orders may reach entities that are hard to compel or able to produce only limited information.

Watch three things: - whether disclosed records actually name alleged intermediaries - whether those intermediaries still hold identifiable balances - whether Bybit can turn legal wins into more than paper freezes

What would keep the story alive-and what would break it

The next real catalyst is whether expedited discovery produces usable records. Bybit now has court authority to seek account identities, balances and transaction histories from entities tied to the flow, and that is where the case can move from legal process to meaningful recovery optionality.

Signals that matter

Watch disclosed filings, not social-media noise. The clearest positive signal would be court records showing progress beyond the initial tracing window, especially if the case continues to target exchanges operating in the United States or maintaining infrastructure there.

• New orders or exhibits that connect wallet clusters to identifiable holders
• Evidence that frozen or contested balances still sit in traceable plumbing rather than deeper laundering chains
• More of the investigation shifting from speculation to compellable intermediaries

What would break the thesis

The story weakens if the records arrive thin, delayed, or jurisdictionally limited. If most of the remaining trail is still lost after the funds passed through mixers, cross-chain bridges, and OTC dealers, then the court win remains largely procedural.

It would also weaken if Bybit cannot turn court victories into more than paper freezes. Earlier progress showed the approach can work in pockets, with a preliminary injunction freezing stolen assets and some assets already frozen or recovered. But if future disclosure shows those pockets are narrowing rather than widening, the opportunity looks tactical rather than structural.