Bybit Files $1.5B Lawsuit Against North Korea Over Crypto Theft

Bybit has filed a civil lawsuit in the U.S. District Court for the District of Columbia accusing North Korea, its Reconnaissance General Bureau, and the Lazarus Group of orchestrating the February 2025 hack that drained more than 400,000 Ether – roughly $1.5 billion at the time – from the exchange. A federal judge issued a preliminary injunction freezing identifiable stolen assets while the case proceeds. The court also granted expedited discovery, allowing Bybit to demand account records and transaction logs from any U.S.-based service provider.

Bybit submitted the complaint under seal on June 18, 2026. Within 24 hours a magistrate approved the discovery order, and on June 19 a temporary restraining directive blocked unnamed respondents from moving any traced digital assets. That order was extended July 16, and the preliminary injunction was partially approved July 30.

Federal investigators had confirmed North Korean involvement on February 26, 2025. U.S. law enforcement agencies track the operation under the label TraderTraitor and have warned crypto platforms to reject transactions tied to the laundering network.

By its own accounting, 90.2% of the stolen crypto had disappeared from traceable blockchain pathways by the time of the filing. The perpetrators used cryptocurrency tumblers and cross-blockchain transfer protocols to obscure the trail. Just 5.3% of the total – about $75.5 million – had been frozen or recovered.

That recovery figure is a steep drop from earlier estimates. CEO Ben Zhou said 12 months ago that 68.57% of the stolen funds remained within tracking range. By April 2025 that share had fallen to 27.6%.