Bybit has sued North Korea, its intelligence agency and the Lazarus Group in a U.S. federal court as the exchange seeks to recover assets stolen in the record $1.5 billion crypto hack.
Summary
- Bybit filed its case against North Korea, the RGB and Lazarus Groupin Washington, D.C.
- A federal judge issued a preliminary injunction freezing certain stolen assetsheld by unidentified defendants.
- The FBI previously attributed the $1.5 billion February 2025 attackto North Korean actors.
- Bybit said the civil case remains separate from ongoing U.S. criminal investigations.
Bybit takes Lazarus Group to US court
Bybit filed the civil lawsuit in the U.S. District Court for the District of Columbia, naming the Democratic Peoples Republic of Korea, its Reconnaissance General Bureau intelligence agency and the Lazarus Group as defendants.
The case concerns the Feb. 21, 2025, breach that drained more than 400,000 Ether (ETH) and staked Ether from the Dubai-based exchange. The assets were valued at about $1.5 billion at the time, making the incident the largest recorded cryptocurrency theft.
The FBI attributed the attack to North Korea shortly after the breach. U.S. authorities track the actors involved under the name TraderTraitor and urged exchanges, validators and blockchain firms to block transactions connected to addresses identified in the laundering operation.
You might also like:
Bitcoin Telegram accounts targeted by North Korean hackers
Bybit co-founder and CEO Ben Zhou said the exchange had worked with investigators, regulators, other trading platforms and law enforcement agencies since the attack.
“Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable,” Zhou said.
Court freezes assets linked to Bybit hack
Alongside the lawsuit, Bybit secured a preliminary injunction covering certain stolen assets held by unidentified individuals and entities listed as John Doe defendants.
The order prevents those defendants from transferring, selling or otherwise disposing of the identified assets while the litigation continues. A preliminary injunction preserves property during a case but does not represent a final ruling on liability or ownership.
Bybit said it would seek further relief as the lawsuit progresses. The company is pursuing the civil claim separately from criminal investigations being conducted by U.S. law enforcement agencies.
The order gives Bybit another route to pursue the stolen funds after months of relying on blockchain tracing, voluntary freezes by industry participants and a bounty program for information leading to recoveries.
Stolen funds became harder to trace
Crypto.news reported in March 2025 that 88.87% of the stolen funds remained traceable, while 7.59% had gone dark and 3.54% had been frozen.
The traceable share later declined as the attackers converted assets into Bitcoin and dispersed them across thousands of wallets. By April 2025, Zhou said 27.6% of the stolen funds could no longer be tracked.
Lazarus-linked wallets used services including cross-chain protocols and crypto mixers to make the transaction trail harder to follow. Bybit previously offered rewards to platforms and investigators that helped identify or freeze the funds.
The exchange also covered the shortfall following the attack through Ether purchases, loans and deposits from industry counterparties, allowing it to continue processing customer withdrawals.
Lawsuit adds to US action against North Korean hackers
The case gives Bybit access to a U.S. civil process while federal agencies continue investigating North Koreas crypto operations. Any recovery will depend on whether the defendants, exchanges or custodians controlling the identified assets comply with the court order.
North Korean groups stole an estimated $2.02 billion in cryptocurrency during 2025, according to Chainalysis data previously covered by crypto.news. The Bybit attack accounted for most of that amount and pushed the countrys estimated cumulative crypto theft to about $6.75 billion.
The threat continued into 2026. As reported by crypto.news, Lazarus-linked attacks allegedly drained another $577 million from Drift Protocol and KelpDAO in April.
Bybits next step will be seeking permanent relief and attempting to recover the assets covered by the injunction. The court has not yet issued a final judgment in the civil case.