The previous article discussed why Bybit chose RICO and how an overseas digital asset attack could reach a U.S. federal court. But reaching the court is only the starting point for recovery. The attackers' identities are unknown and the assets are still moving on-chain. Even if the court is willing to intervene, three practical problems must first be resolved: how to commence litigation without knowing the defendants' names, how to preserve the assets before the attackers learn of the litigation, and how to make court orders produce practical effects through trading platforms, custodians and the sanctions system.
IV. How Anonymous Defendants Enter Litigation: John Doe, Identity Tracing and Alternative Service
Traditional litigation usually identifies the defendants first and then completes filing and service. In digital asset cases, however, victims can often see the assets on-chain but do not know who is behind the wallets—a wallet address does not reveal the controller's name, nationality or contact details. An address may belong to an attacker, or it may be a trading platform's omnibus wallet, a custodian's service address, an OTC desk's trading address, or even an ordinary user who merely had a normal transaction involving the funds at issue. If filing had to wait until the identity of every address controller were established, the stolen assets might long since have been split again, bridged across chains or cashed out.
The John Doe mechanism offers a way out of this dilemma: it allows litigation to be commenced before the defendants' identities are known.
John Doe: Reserving a Litigation Position for Anonymous Parties
"John Doe" is a U.S. litigation placeholder for defendants whose identities are temporarily unknown. It allows a plaintiff who has some leads on conduct and property, but cannot yet confirm real names, to reserve a litigation position for the relevant parties. This arrangement changes the sequence of litigation in digital asset cases: Bybit need not wait until the controller behind every address has been identified before taking action; it can first commence the case on the existing on-chain evidence and then, based on information obtained later, substitute the anonymous defendants with real names or add named defendants.
Of course, this does not mean a plaintiff can sue any unknown party without any leads. A plaintiff generally needs to explain to the court that: a party that committed the relevant conduct or controls the relevant property does in fact exist; its identity cannot be determined at this stage through reasonable investigation; the plaintiff already possesses information sufficient to identify its conduct, accounts or property; and, as the litigation proceeds, its identity may be determined through civil discovery. In the Bybit case, the anonymous defendants are identified primarily by wallet addresses and fund paths. Bybit cannot yet tell the court "what the defendants are called," but it can explain which addresses received or transferred the stolen assets and why those addresses may be connected to theft or money laundering.
This makes wallet addresses a temporary "identity coordinate": they cannot replace the defendants' real identities, but they can help Bybit define the subjects of investigation, describe the relevant conduct and assets, and provide a starting point for subsequent identity investigation and preservation applications.
2. From Wallet Addresses to Real-World Identities: How Anonymous Defendants Are Identified
Public blockchain records can show transaction times, asset quantities, sending and receiving addresses and fund flow paths, but they cannot directly reveal the natural persons or entities behind the addresses. To trace the real identities of the John Does, Bybit still needs to complete the conversion from "wallet addresses" to "real-world subjects." This process roughly comprises three steps: the first is on-chain analysis. Based on funding sources, transaction times, Gas fee payment addresses, asset-splitting methods, cross-chain paths and historical interaction relationships, it assesses whether multiple wallets may be controlled by the same entity and identifies recurring transaction patterns among them.
For example, if multiple addresses receive funds at similar times, use Gas fees from the same source, split assets in similar proportions and concentrate the funds into the same platform account, this may indicate a common control relationship among those addresses. However, this analysis usually produces only investigative leads, not a final identity conclusion. The second step is to look for centralized nodes. When funds enter centralized exchanges, custody platforms, stablecoin issuance systems or fiat currency exchange channels, anonymous addresses may begin to connect with real-world identities. These institutions may hold customer KYC materials, login IPs, device information, withdrawal addresses, bank accounts, transaction records and internal risk investigation results.
Of course, such materials are usually subject to contractual, privacy and data protection obligations, and the relevant institutions may not be able to disclose them directly on the strength of a single demand letter from Bybit, especially where the information crosses different jurisdictions; the platform often needs a court subpoena, a judicial assistance request or other formal legal basis. The third step is to obtain materials through civil discovery procedures. Once the case is commenced, Bybit may, where legal conditions are met, apply for a subpoena or other investigative order to obtain materials from third parties holding relevant information, and then compare and cross-verify the platform account information, login information and fund records against the on-chain addresses. This forms a relatively complete investigative path: on-chain analysis identifies the fund path, records held by centralized institutions identify the real-world identity, and court proceedings connect the two.
3. The evidentiary thresholds that must be crossed from identity identification to liability determination
Even if Bybit identifies the actual controller of a wallet through the above path, it cannot, merely because that wallet received the assets at issue, determine that the person is a member of Lazarus or participated in the criminal network alleged under RICO; a considerable evidentiary gap remains in between. The same assets at issue entering a certain address may have multiple explanations: the address may be directly controlled by the attacker, or may belong to an intermediary who assisted in transferring the funds; it may be a collection wallet of a trading platform or custodian, or an ordinary user who unintentionally received the assets at issue in the course of normal transactions; in some cases, the funds may also have briefly passed through an address due to the automatic execution of a smart contract.
Therefore, an on-chain fund connection can at first only prove how the assets moved. To further convert such a connection into legal liability, Bybit must at least prove three levels of issues: first, that the relevant assets did indeed originate from this attack; second, that the addresses and transactions at issue can be attributed to a specific entity; and third, that the entity knew the source of the funds and actually participated in the attack, transfer, concealment or monetization activities.
Among these, the source of the assets mainly depends on on-chain fund tracing; address control requires combining platform accounts, login IPs, device information and other off-chain materials; and subjective knowledge and actual participation usually require a comprehensive assessment of evidence such as analysis of behavioral patterns, for example: whether the entity repeatedly received funds from the same theft incident, whether it used splitting, mixing or cross-chain operations with obvious avoidance characteristics, whether it had long-term interactions with known Lazarus addresses, whether it processed assets according to a uniform rhythm, and whether there are communication records, remuneration arrangements or other evidence that it assisted in transferring funds while knowing their source. This is also the boundary of the John Doe mechanism. It allows Bybit to commence litigation and investigation while the identity of the defendant is not yet fully ascertained, but it does not lower its ultimate burden of proof.
A wallet address can serve as an investigative lead and a procedural identifier of the defendant, but it cannot directly substitute for proof of the defendant's identity, specific conduct, subjective knowledge and legal liability.
4. The service-of-process challenge for anonymous defendants
Even if Bybit describes the anonymous defendant by wallet address, another procedural issue still needs to be resolved: how can the controller behind the address know that he or she has been sued? Service is not simply "sending out" litigation documents; it is to ensure that the defendant receives reasonable notice and an opportunity to respond. Without lawful service, a default judgment entered by a court against an anonymous defendant may be challenged in subsequent proceedings and may also affect the recognition and enforcement of the judgment. Traditional in-person service or service by mail is difficult to apply to a defendant identified only by an on-chain address.
In similar digital asset cases, the plaintiff may apply to the court for approval of alternative service, for example, sending notice to a known email address or social media account, serving through in-platform messages to a trading platform account, publishing the litigation documents on a designated website, or sending an on-chain message containing a link to the litigation notice to the wallet address. In this case, Bybit sent an NFT to the wallets at issue, stating the temporary restraining order and the deadline for objections, and providing links to the complaint and the court order. When approving the preliminary injunction, the court recognized that such notice satisfied the procedural requirements at the preliminary injunction stage. However, this finding must be understood in the context of the specific procedural stage. U.S. courts distinguish between "notice" and "service of process," and the two have different legal meanings at different stages of litigation.
At the preliminary injunction stage, under Rule 65(a)(1) of the Federal Rules of Civil Procedure (Fed. R. Civ. P. 65(a)(1)), the court may not issue a preliminary injunction without notice to the adverse party. The notice here need not meet the formal service standard under Rule 4, but it must, under the specific circumstances, be reasonably calculated to make the relevant entity aware of the proceedings and give it an opportunity to raise objections. In this case, after Bybit gave notice through the NFT, one wallet controller actually raised an objection, which also shows that the notice did reach the relevant entity. When the case further proceeds to substantive adjudication, especially where Bybit seeks a final judgment in the defendant's absence, the strict requirements of Fed. R. Civ. P. 4 regarding the manner of service must be satisfied.
A default judgment presupposes that the defendant, after lawful service, still failed to respond, and lawful service requires compliance with standards such as statutory form, verifiability and contestability.Whether an NFT can independently constitute a method of service before a final judgment requires Bybit to file a separate application and obtain court approval. Therefore, the procedural value of the NFT in this case should be accurately defined: it resolved the issue of how to send procedural notice to an anonymous entity at the emergency preservation stage, but it has not yet resolved the issue of how to complete lawful service at the final judgment stage. In addition, the service paths for different defendants also need to be discussed separately.
The above NFT notice is primarily directed at the controllers of anonymous wallets; for North Korea, a foreign state defendant, Bybit must complete service in accordance with the sequential procedures set out in Fed. R. Civ. P. 4(j)(1) and Section 1608(a) of the FSIA; for non-state defendants such as the Lazarus Group and its members, service rules such as Fed. R. Civ. P. 4(f)(h) should apply according to the nature of the entity and its location. In other words, even if the NFT is ultimately approved as an alternative method of service on some of the anonymous defendants, that does not automatically resolve the service issue for all defendants.
The practical limits of the John Doe strategy
The John Doe strategy secured a litigation position and a window of time for Bybit, but it cannot eliminate the difficulties posed by anonymity and cross-border investigation. If the attackers consistently use non-custodial wallets, peer-to-peer transactions and offshore services that do not conduct KYC, Bybit may never be able to confirm their true identities. In addition, subpoenas issued by U.S. courts may not directly bind all offshore platforms, and Bybit may also need to seek local judicial assistance, subject to the constraints of the data protection, bank secrecy and evidentiary rules of the relevant jurisdictions. At the same time, notifying the defendants may itself create new risks. Once the complaint becomes public, the anonymous controllers may immediately split up or transfer assets that are still traceable.
Bybit must therefore also resolve a more pressing timing question: how can it obtain a court order preserving the assets before the attackers learn of the litigation?
V. The timing battle over asset preservation: sealed filing, emergency injunctions and centralized nodes
Traditional litigation proceeds in days and weeks, while on-chain assets move in seconds and minutes.
Once the complaint is made public, wallet controllers can quickly move funds into channels that are harder to identify and control. Bybit therefore adopted a phased asset-preservation arrangement: first, it filed the lawsuit under seal, temporarily keeping the complaint, wallet addresses and investigation paths from public disclosure in order to gain an information and timing advantage; second, it applied for a TRO and a preliminary injunction to restrict the relevant parties from disposing of the identified assets at issue; and finally, by relying on real-world control nodes such as trading platforms, custodians and stablecoin issuers, it sought to translate court orders into actual restrictions as far as possible.
1. Public disclosure of the litigation may expose the targets of tracing and preservation
After the attack in February 2025, Lazarus and the relevant fund controllers already demonstrated highly sophisticated asset-transfer capabilities. The stolen ETH was rapidly split, exchanged and bridged across chains, with the aim of increasing the difficulty of tracing and escaping, as far as possible, the control of trading platforms, stablecoin issuers and law enforcement agencies. If Bybit had made the litigation public before obtaining preservation measures, the complaint and its exhibits could have exposed three key categories of information to the attackers: which wallet addresses had already been identified, which fund paths had already entered the scope of investigation, and which assets were about to face legal restrictions. Such information would have served as an early warning for the attackers to move assets, allowing them to change addresses, adjust their money-laundering paths, or transfer funds into services lacking KYC and freezing capabilities.
By the time the court completed ordinary notice, held hearings and reached a decision, the assets that could originally have been controlled would long since have disappeared. This constitutes a procedural paradox in digital asset recovery: litigation should in principle be public and the defendants notified, but premature disclosure and notification may ultimately deprive the litigation of enforceable property. What Bybit needed to do was to strike a balance between procedural due process and the urgency of asset preservation.
2. Using sealed proceedings to secure a window for asset preservation
Litigation filings in U.S. federal courts are in principle open to the public, but where advance disclosure could lead to asset transfers, obstruct an investigation, or expose sensitive information, the parties may apply to seal the case or specific materials for a defined period. A sealed complaint does not mean that the court may conduct secret proceedings and directly issue a final judgment. It is usually only an interim procedural arrangement intended to temporarily limit the public scope of the complaint, wallet addresses, and investigative leads, so that the court can review an application for emergency relief before the attackers learn of the action. Bybit filed its complaint under seal on June 18, 2026, and the relevant case file was only partially unsealed on August 6, after the court had already taken interim measures and decided on the preliminary injunction; Bybit then formally announced the case to the public the following day.
This chronology reflects Bybit's strategic priorities: first, avoiding premature disclosure of investigative information through sealed proceedings, during which it sought emergency relief; then, after the court adopted interim measures, making the case public and promoting broader platform cooperation.
3. Two-Tier Emergency Relief: From TRO to Preliminary Injunction
The emergency relief sought by Bybit primarily consisted of a temporary restraining order and a preliminary injunction, which address issues at different stages. A temporary restraining order (TRO) is mainly used to address extremely urgent situations. Where waiting for full notice and a hearing could cause irreparable harm, the court may, under strict conditions, take short-term measures first to temporarily maintain the status quo. In digital asset cases, Bybit needed to explain that the assets were being continuously transferred and that advance notice could defeat the purpose of preservation; once these still-identifiable and traceable assets entered channels beyond control, its claims for return of assets and related equitable relief could lose their practical basis.
The TRO functions like pressing a "pause button" first, buying time for subsequent service, investigation and hearings.However, it is usually of short duration and cannot replace formal review over the long term. If Bybit wished the restrictions to remain effective during the litigation, it also needed to obtain a preliminary injunction. Compared with a TRO, a preliminary injunction may last until the court issues a further order or the case proceeds to adjudication on the merits, so courts usually need to examine more fully factors such as the plaintiff's likelihood of success on the merits, whether there is irreparable harm, the balance of interests between the parties, and the public interest. On July 30, 2026, the court partially granted Bybit's application for a preliminary injunction, prohibiting the relevant anonymous defendants from transferring, selling or dissipating the identified assets at issue.
Of course, whether a TRO or a preliminary injunction, there are clear boundaries to the scope of assets a court may restrict. In principle, a court cannot freeze all of a defendant's property without limitation merely to secure a future monetary judgment. Mere concern that a defendant may transfer assets and that there will be insufficient property to satisfy a monetary judgment is usually insufficient to support an undifferentiated asset freeze. Therefore, Bybit needed to establish a clear connection between the emergency relief and specific assets at issue, traceable proceeds, claims for return or other equitable relief. An injunction should target assets that can be reasonably identified and are related to this attack, rather than all property under the control of the anonymous defendants.
4. A Court Order Is Not a Technical Freeze: How Injunctions Operate on Digital Assets
The Ethereum network does not recognize U.S. court docket numbers, nor will it automatically refuse to include transactions because of a federal court order. What a court can bind is not the blockchain protocol itself, but the conduct of relevant entities in dealing with the assets at issue. Under Fed. R. Civ. P. 65(d)(2), an injunction binds the parties to the case, their agents and employees, and other persons who actively act in concert with them after actual notice of the injunction. A court may order the relevant defendants not to transfer the assets at issue, and may also hold bound entities accountable where they knowingly assist in transferring such assets despite the injunction. Under the foregoing scope of regulation, trading platforms, custodians and stablecoin issuers are not automatically bound.
Nevertheless, a court order can still serve as an important basis for such entities to conduct freeze reviews, preserve materials or take other risk-management measures pursuant to their user agreements, internal compliance policies and applicable local law. As to the effect of an injunction, whether a court order can actually stop the movement of assets depends to a large extent on where the assets are located at the time.
• If the ETH remains in a non-custodial wallet whose private keys are held by the attacker, the court can prohibit the relevant defendants from transferring the assets, but it cannot modify blockchain rules or technically prevent them from continuing to sign transactions.
• If the assets have already entered a centralized trading platform or custodian, the platform may prevent further outflow of assets by restricting trading and withdrawals.
• If the assets at issue are converted into stablecoins with address-freezing functionality, the issuer may also, where legal and technical conditions are met, restrict further transfer or redemption of the relevant tokens.
This is precisely the key role of centralized nodes in asset recovery. Attackers may not voluntarily comply with court orders, but in the course of transferring, custoding, or liquidating assets, they will usually come into contact with trading platforms, custodians, stablecoin issuers, and payment service providers. These entities possess the ability to control accounts, private keys, or tokens, and therefore may be able to translate a court's legal orders into practical measures such as account freezes, withdrawal restrictions, preservation of records, and risk management.
Therefore,The so-called "freezing of digital assets" does not mean causing the blockchain to stop processing transactions; rather, it means constraining the relevant entities through legal orders and, with the help of real-world nodes that possess the ability to control accounts, private keys, or tokens, preventing assets from continuing to flow out.What the United States District Court for the District of Columbia provides is a legal fulcrum from which recovery can be continuously extended outward, rather than a global passport, because a U.S. court injunction does not automatically acquire enforcement effect in the local jurisdiction merely because it has been sent to an overseas platform. Where necessary, Bybit may still need to seek judicial assistance in other countries or regions, obtain recognition of the relevant orders, or re-obtain local asset preservation measures.
VI. Dual-track coordination between sanctions and litigation
Before Bybit filed its lawsuit, North Korea, the Reconnaissance General Bureau of North Korea, and the Lazarus Group had long been subject to the U.S. sanctions regime. Since transactions with sanctioned entities are already subject to strict restrictions, why did Bybit still need to separately file a civil lawsuit and apply for a judicial injunction?
In fact, sanctions and civil litigation address issues at different levels.
Sanctions are aimed at national security and foreign policy and mainly restrict sanctioned entities and their property from entering the financial and commercial systems under U.S. jurisdiction; civil litigation, by contrast, revolves around the specific assets in the case and requires further determination of where the assets came from, who controls them, what rights Bybit enjoys, and what remedies the court can provide.
1. The functional boundaries of sanctions
U.S. economic sanctions against North Korea and related entities are mainly implemented by the U.S. Department of the Treasury's Office of Foreign Assets Control, or OFAC. The relevant rules may prohibit persons subject to U.S. jurisdiction from engaging in transactions with specified persons and require U.S. persons to block sanctioned property held or controlled by them. However, blockchain protocols do not read the OFAC list. As long as the attacker still controls the private keys, they can sign transactions from non-custodial wallets—sanctions restrict the ability of assets to enter compliant trading platforms, custodians, and fiat currency exit channels, rather than technically disabling the transfer function. In addition, when attackers constantly change addresses and conceal the source of funds through splitting, cross-chain transfers, coin mixing, and over-the-counter transactions, platforms must further determine "whether this asset, after multiple layers of transfer, is still controlled by a sanctioned entity."
Therefore, sanctions can increase the difficulty of circulating and liquidating assets, but it is difficult to resolve on-chain identification issues based on lists alone. More importantly, sanctions only answer "which transactions may not be carried out," not "to whom the assets ultimately belong": the fact that the relevant property may not be transferred without authorization does not mean that it will automatically be returned to Bybit. Whether assets can still be traced back to this attack after multiple cross-chain transfers, how much should be frozen when only part of the funds in a wallet come from stolen assets, how to distinguish assets after they are commingled with other users' property, whether a third party acquired the assets without knowledge, and whether frozen property should ultimately be disposed of by the government or returned to the victims—these questions have entered the realm of property ownership and evidentiary determination and cannot be resolved by sanctions rules alone.
2. The supplementary function of civil litigation: identifying assets, asserting rights, and obtaining remedies
Civil litigation supplements the sanctions regime primarily in three respects. First, litigation translates the general risks associated with sanctioned entities into specific assets connected to this attack. OFAC sanctions primarily proceed from the sanctioned country, organization or individual, restricting property that they own or control; the Bybit litigation, by contrast, proceeds from the assets transferred out on February 21, 2025, tracing on-chain transaction paths to identify the relevant wallets, platform accounts and current balances. Second, litigation provides a procedure for Bybit to assert rights in the assets. Bybit must prove that a verifiable connection exists between the relevant assets and this attack, what rights it holds in the relevant assets, and whether the assets may still be claimed for return after being exchanged, bridged across chains or commingled.
OFAC's sanctions designations and list information may indicate that the relevant entities or transactions present elevated risk, but they cannot by themselves prove that particular assets originated from this attack, nor can they replace Bybit's proof of asset ownership and its claim for return. Finally, litigation can provide judicial remedies such as asset preservation, disclosure of information, cessation of disposal and ultimate return. Compared with the private freeze requests Bybit makes based on industry cooperation, court orders can provide a clearer procedural basis for entities that are legally bound to take measures, and can also provide a more weighty reference for other platforms conducting internal investigations, preserving information and assessing whether to continue processing the relevant assets. However, a civil judgment also cannot automatically lift sanctions restrictions.
Even if a court ultimately upholds Bybit's claims, if the assets to be returned constitute blocked property under OFAC rules and the relevant release or transfer is subject to U.S. sanctions rules, the court judgment itself will not automatically unfreeze the assets. Actual return still requires compliance with an applicable OFAC general license or the obtaining of a specific license issued by OFAC.
A court judgment resolves "who is entitled to obtain the assets," while an OFAC license resolves "whether the assets may be released or transferred within the sanctions framework"; the two may need to operate together.
If sanctions are likened to an access gate, they primarily prevent sanctioned entities and their property from entering the compliant financial system; civil litigation, in turn, further ascertains where the specific assets outside the gate came from, who owns them, and how they should ultimately be handled.
3. Multiple risks transmit outward to the peripheral service network
North Korea and the Lazarus Group are already highly isolated from the U.S. financial system. Adding a civil lawsuit or court injunction may not be sufficient to directly change their conduct. What may genuinely reassess risk is the peripheral service network that still relies on the global financial system. These entities may include centralized trading platforms and custodians, OTC dealers and fiat currency exchange channels, stablecoin issuers, payment and settlement institutions, banks, and individuals and companies that support accounts, identity or fund transfers. They may not be located in the United States, and may not have directly participated in the original hacking attack, but many still rely on U.S. dollar settlement, international banking networks, commercial licenses, investment institutions or global compliance partnerships.
When the same funds are simultaneously targeted by an FBI notice, an OFAC sanctions risk alert, a Bybit tracing notification and a court injunction, continuing to process those assets may give rise to multiple risks. The first layer is sanctions risk. If a platform subject to U.S. sanctions rules continues to provide trading, custody or transfer services for assets owned or controlled by a sanctioned entity, it may trigger the relevant prohibitions. OFAC civil liability for sanctions generally applies a strict liability standard, meaning that it does not presuppose that the platform actually knew the source of the assets (although, in enforcement practice, OFAC will of course generally consider factors such as whether the platform received risk alerts, whether it adopted reasonable compliance measures, and whether it voluntarily disclosed and cooperated with the investigation).
Nevertheless, continuing to process the relevant assets after receiving a clear risk alert will significantly increase the risk of enforcement action against the platform. The second layer is anti-money laundering and licensing risk. If a platform disregards an obviously high-risk fund path, it may be investigated by the regulator in its jurisdiction, and its banking relationships and the continuity of its licenses may also be affected. The third layer is civil liability risk. If the evidence shows that certain entities, after receiving government notices, victim notifications or court orders, still knowingly and continuously assisted in transferring, concealing or liquidating assets, the relevant facts may be used to support RICO conspiracy, aiding tort or other liability claims (although receiving notice or handling the assets at issue does not, in itself, automatically make a platform a member of a criminal network; Bybit must still prove its actual knowledge, degree of participation and specific conduct).
It can thus be seen that the synergy between sanctions and litigation is primarily not to force North Korea, which is already detached from the U.S. financial system, to change its conduct, but to raise the cost for the peripheral service network to continue processing the assets at issue: more platforms may refuse to receive the funds, more accounts may enter internal investigation, and entities that knowingly assist in transferring assets may also face higher civil and regulatory risk.
4. Litigation evidence supports sanctions and enforcement in reverse
Sanctions and enforcement records can provide state attribution and risk context for the Bybit litigation; conversely, new information obtained by Bybit in civil litigation, on-chain investigations and cross-platform collaboration may also become leads for subsequent sanctions or enforcement actions. Through on-chain tracing and evidence discovery, Bybit may identify previously undisclosed wallet addresses, trading platform accounts, device information, fund exit points or real-world controllers. If such information shows that certain entities have long knowingly assisted Lazarus in transferring or laundering assets, Bybit may submit the relevant leads to the FBI, the U.S. Department of Justice, OFAC and regulatory and law enforcement agencies in other countries.
The relevant authorities may, within their respective mandates and evidentiary standards, further investigate whether to add new sanctions targets or associated addresses, bring money-laundering or sanctions-evasion charges, seek criminal forfeiture, or impose account freezes and licensing supervisory measures on the platforms concerned. This forms a two-way information chain: sanctions and government attributions provide the background for Bybit to identify and freeze high-risk entities and assets, while new evidence obtained by Bybit through on-chain tracing, platform cooperation and civil discovery may in turn drive additional sanctions, criminal investigations and asset forfeiture.
At this point, RICO, John Doe, sealing procedures, emergency injunctions and the sanctions regime together form a litigation path running from liability tracing to asset preservation, and Bybit's principal litigation strategy has come full circle. Yet however meticulously designed the strategy may be, it must ultimately return to a practical question: where the stolen assets, amounting to USD 1.5 billion, have already undergone prolonged splitting, cross-chain transfers and laundering, how much can this litigation strategy actually recover? Of the funds that are "visible" on-chain, how much can truly be placed under control, proven and enforced, and ultimately returned to Bybit's hands?
