US Court Freezes More Stolen Crypto in Bybit's North Korea Suit

Recovery so far has brought in a small slice of the stolen funds. Bybit said about $48.4 million linked to the hack has been recovered, and another $30.5 million remains frozen across more than 28 exchanges and custodians. Combined, the two figures total about $78.9 million, roughly 5% of the $1.5 billion taken in February.

Those funds remain subject to further legal and investigative procedures as recovery efforts continue. Freezing stolen crypto does not automatically return it to an exchange. Investigators must identify assets and establish links to the theft before a court order can restrict movement, after which ownership questions proceed through legal channels. Bybit continues tracing wallets, transactions, exchanges, custodians and services connected with the stolen crypto while the federal lawsuit stays active.

Lazarus has used several routes to move funds after major thefts. Chainalysis has documented bridge services and mixing protocols in North Korean laundering patterns. The group also splits funds into smaller transaction tranches, spreading crypto across many addresses and networks.

Bybit said enforcement actions have also targeted services allegedly used to move illicit proceeds. German authorities dismantled the eXch cryptocurrency exchange. Cryptomixer.io was later disrupted by German and Swiss authorities, and Bybit links both actions to wider efforts against laundering infrastructure tied to the stolen funds.

The civil suit does not replace criminal investigations by U.S. authorities, Bybit said. The exchange shares blockchain intelligence and investigative findings with the FBI, analytics firms, exchanges, custodians and international law enforcement partners.

Bybit said it plans additional judicial relief as the case proceeds, including requests over assets already located through tracing. The preliminary injunction currently covers assets held or moved by the John Doe defendants named in the lawsuit.