The cryptocurrency exchange Bybit has initiated a civil lawsuit against North Korea, its intelligence agency, and the Lazarus Group, following a theft of $1.5 billion that occurred in February 2025. The suit also names twenty unidentified individuals and entities as defendants.

The FBI confirmed the involvement of North Korean hackers in the breach shortly after the incident.

Bybit submitted its legal filings to the U.S. District Court for the District of Columbia on June 18. The exchange is seeking the return of the stolen assets, compensation amounting to around $1.5 billion, as well as punitive damages and treble damages under the U.S. Racketeer Influenced and Corrupt Organizations (RICO) Act.

The court has granted the exchange's requests in three phases:

  • June 19 — expedited discovery and restrictions on transactions involving the traced assets;
  • July 16 — extension of these restrictions;
  • July 30 — partial approval of the request for a preliminary injunction.

Some case materials remain sealed.

Through the expedited discovery process, Bybit has gained the right to request information from U.S. trading platforms regarding account holders, balances, and transactions. Bybit claims that a portion of the stolen funds has ended up on these platforms. Some have agreed to cooperate following the receipt of court orders.

“Our mission remains unchanged: to protect users, recover as much as possible, and hold the perpetrators accountable. The Lazarus attack targeted not just Bybit — it undermined trust in the entire industry,” stated Ben Zhou, co-founder and CEO of Bybit.

The company emphasized that the civil proceedings are running concurrently with criminal investigations by U.S. law enforcement and are independent of them.

Less Than 10% of Stolen Funds Traced

By the time the lawsuit was filed, 90.2% of the stolen funds had become untraceable, having passed through mixers, cross-chain bridges, and over-the-counter dealers. Only 9.8% of the funds were found in identifiable wallets. Of this amount, only 5.3% of the total, equating to approximately $75.5 million, has been frozen or recovered.

In contrast, a year earlier, Zhou had estimated that 68.6% of the assets were traceable.

Cryptocurrency as a New Revenue Source for Pyongyang

The stolen cryptocurrencies have emerged as an independent revenue stream for North Korea. According to Bloomberg Economics, from 2022 to 2025, the country generated up to $22 billion from abroad — nearly four times the amount received in the previous four years. This estimate is based on trade statistics, intelligence reports, and independent studies.

While military-technical supplies from Russia provided substantial income to Pyongyang, Kim Jong-un has been expanding other revenue channels. Data from TRM Labs indicates that the share of global cryptocurrency thefts attributed to North Korean hackers has increased from 30% in 2017 to 70% today.

Chinese criminal groups are reportedly involved in laundering these funds by offering offshore accounts for a fee, as noted by TRM Labs investigator Nick Carlsen.

“It is absurd that North Korea has access to such funds,” he remarked, suggesting that the U.S. implement a reward system for information leading to the recovery of stolen assets.

The revenue generated is believed to be funneled into the country's nuclear program. Bloomberg posits that within ten years, North Korea's arsenal could rival that of France. However, the accuracy of these estimates is limited, as the country does not publish statistics, conceals transactions, and a portion of the revenue remains overseas due to lack of access to the banking system.

In early August, Greek cybersecurity expert Vangelis Stikas found evidence of North Korean-linked hackers infiltrating the systems of 1,640 organizations across 57 countries.

Earlier, analysts from CertiK highlighted that North Korean criminals have turned cryptocurrency theft into a large-scale state operation with its own money laundering infrastructure and a network of IT agents.