Summary

  • Bybit has initiated a lawsuit against North Korea, its Reconnaissance General Bureau, and the Lazarus Group in a U.S. federal court regarding the $1.5 billion theft that occurred in February 2025.
  • A judge has issued a preliminary injunction to freeze the identified stolen assets, indicating that Bybit has a strong likelihood of winning the case.
  • To date, approximately $48 million has been recovered and an additional $31 million has been frozen across over 28 exchanges and custodians.

The cryptocurrency exchange Bybit has filed a civil lawsuit against North Korea following the theft of $1.5 billion from its platform in February 2025. The lawsuit secured a court order to freeze assets that have been identified as stolen.

This legal action, brought before the U.S. District Court for the District of Columbia, names the Democratic People's Republic of Korea, its Reconnaissance General Bureau, and the Lazarus Group, which U.S. officials have associated with the hack. Additionally, unnamed individuals and entities involved in handling or transferring the stolen funds are listed as John Doe defendants.

A judge has granted a preliminary injunction that prohibits the transfer or dissipation of the identified assets while the litigation is ongoing, indicating that Bybit is likely to prevail in its claims, according to the exchange's statement on Friday. An earlier temporary restraining order characterized the theft as one of the most significant in the industry to date.

Ben Zhou, co-founder and CEO of Bybit, stated in a Thursday announcement, "It was an attack on trust in our industry," emphasizing the exchange's collaboration with investigators, other exchanges, regulators, and law enforcement prior to pursuing legal action.

Bybit reported that around $48.4 million has been recovered, and approximately $30.5 million has been frozen, totaling about 5% of the stolen funds, across more than 28 exchanges and custodians.

Distribution of the Stolen Funds

During the attack, the hackers extracted nearly 500,000 ETH from a Bybit cold wallet by manipulating a signing interface that misled approvers while modifying the wallet's core logic. Zhou assured at the time that the exchange remained solvent and could absorb the loss.

By April, Zhou indicated that around 69% of the stolen funds were still traceable, with 28% having vanished and 4% frozen. Much of the stolen Ethereum was converted to Bitcoin through Thorchain and moved via mixers like Wasabi, Tornado Cash, and Railgun. In June, Greek authorities managed to trace some of the funds back to a wallet on a local exchange, leading to a seizure order.