- Bybit has filed a civil lawsuit in the U.S. District Court for the District of Columbia against North Korea, its Reconnaissance General Bureau, and the Lazarus Group over the $1.5 billion theft.
- A federal judge granted a preliminary injunction freezing identified stolen assets and found Bybit likely to succeed on the merits.
- Approximately $48.4 million has been recovered and $30.5 million frozen across more than 28 exchanges and custodians.
- The February 2025 hack remains the largest cryptocurrency theft in history, with most funds laundered beyond easy recovery.
Crypto exchange Bybit has filed a civil lawsuit against the Democratic People’s Republic of Korea, its Reconnaissance General Bureau and the Lazarus Group, seeking to hold the state-sponsored actors accountable for the $1.5 billion theft that occurred in February 2025.
According to a company statement, the suit was filed in the U.S. District Court for the District of Columbia. The court has granted a preliminary injunction freezing identified stolen assets held by unidentified John Doe defendants and determined that Bybit has demonstrated a likelihood of success on the merits.
In the statement, Bybit co-founder and CEO Ben Zhou said the Lazarus attack “wasn’t just an attack on Bybit. It was an attack on trust in our industry.” He added that the exchange has worked with investigators, exchanges, regulators and law enforcement before turning to the courts.
To date, Bybit reports that approximately $48.4 million in stolen assets has been recovered, while more than $30.5 million remains frozen across more than 28 exchanges and custodians. These figures represent roughly 5% of the total amount taken, as detailed in coverage by Decrypt and CoinDesk.
The February 21, 2025 incident involved the theft of over 400,000 ETH and stETH from a Bybit cold wallet, marking the largest crypto heist on record. U.S. authorities, including the FBI, have attributed the attack to North Korean actors linked to the Lazarus Group. Court records unsealed in recent days, as reported by Cointelegraph, show the lawsuit was initially filed under seal in June 2026, with the court granting expedited discovery and later the preliminary injunction.
Most of the stolen funds have been laundered through mixers, bridges and OTC dealers, rendering about 90% untraceable by the time of filing. Bybit continues to pursue recovery in parallel with ongoing criminal investigations and has supported related enforcement actions, including the disruption of certain laundering services.
The civil action seeks the return of the stolen assets, compensatory damages, punitive damages and treble damages under the Racketeer Influenced and Corrupt Organizations Act. Proceedings remain ongoing.
