
North Korea and the Lazarus Group are named defendants in Bybit's $1.5B suit. About $48.4M is recovered and $30.5M frozen across 28 exchanges as the case proceeds.
Bybit has filed a civil lawsuit against North Korea over the theft of $1.5 billion from the exchange in February 2025, and won a court order freezing stolen assets that investigators have identified.
The suit, filed in the U.S. District Court for the District of Columbia, names the Democratic People's Republic of Korea and its Reconnaissance General Bureau as defendants, along with the Lazarus Group, the state-linked hacking outfit U.S. authorities blame for the attack. Unidentified individuals and entities holding or moving the funds are named as John Doe defendants.
A judge granted a preliminary injunction barring the transfer or dissipation of identified assets while the case proceeds, and found Bybit likely to succeed on the merits, the exchange said on Friday. In granting an earlier temporary restraining order, the court described the theft as among the biggest the industry has seen.
"It was an attack on trust in our industry," co-founder and CEO Ben Zhou said in a statement Thursday, adding that Bybit had worked with investigators, exchanges, regulators and law enforcement before turning to the courts.
Bybit said around $48.4 million has been recovered and about $30.5 million frozen across more than 28 exchanges and custodians. Together that amounts to roughly 5% of what was taken.
Attackers drained about 500,000 ETH from a Bybit cold wallet in February 2025 after manipulating a signing interface. The tool showed approvers the correct destination address while altering the wallet's underlying logic. Zhou said at the time the exchange was solvent and could cover the loss.
By April, Zhou said 69% of the proceeds remained traceable and 28% had gone dark. Most of the stolen Ethereum was converted to Bitcoin via Thorchain and pushed through mixers including Wasabi and Tornado Cash. In June, Greek authorities traced a portion of the money to a wallet on a domestic exchange and issued a seizure order.
Bybit said the civil case runs alongside criminal investigations, and that it continues to share blockchain intelligence with agencies including the FBI. It pointed to Germany's takedown of the eXch exchange and the disruption of Cryptomixer.io by German and Swiss authorities as evidence of that cooperation.
The proceedings are ongoing.
Drafted by a large language model from the source reporting linked above, then screened by automated publishing checks. It is not read by a journalist before publication. Some articles cite our Alpha Score. Verify prices and figures against the original source. Educational coverage, not personalized advice.