In brief
- Bybit has sued North Korea, its Reconnaissance General Bureau and the Lazarus Group in U.S. federal court over the $1.5 billion theft from the exchange in February 2025.
- A judge granted a preliminary injunction freezing identified stolen assets and found Bybit likely to succeed on the merits, according to the exchange.
- Some $48 million has been recovered and $31 million frozen across more than 28 exchanges and custodians.
Crypto exchange Bybit has filed a civil lawsuit against North Korea over the theft of $1.5 billion from the exchange in February 2025, and secured a court order freezing stolen assets that investigators have identified.
The suit, filed in the U.S. District Court for the District of Columbia, names the Democratic People’s Republic of Korea, its Reconnaissance General Bureau and the Lazarus Group, the state-linked hacking outfit U.S. authorities blame for the attack. Unidentified individuals and entities holding or moving the funds are named as John Doe defendants.
A judge granted a preliminary injunction barring the transfer or dissipation of identified assets while the case proceeds, and found Bybit likely to succeed on the merits, the exchange said on Friday. In granting an earlier temporary restraining order, the court characterized the theft as among the biggest the industry has seen.
“It was an attack on trust in our industry,” the firm’s co-founder and CEO Ben Zhou said in a statement Thursday, adding that Bybit had worked with investigators, exchanges, regulators and law enforcement before turning to the courts.
Bybit said that around $48.4 million has been recovered and about $30.5 million frozen across more than 28 exchanges and custodians, together amounting to approximately 5% of what was taken.
Where the money went
Attackers drained roughly 500,000 ETH from a Bybit cold wallet in February 2025, after manipulating a signing interface that showed approvers the correct destination address while altering the wallet’s underlying logic. Zhou said at the time that the exchange was solvent and could cover the loss.
By April, Zhou said some 69% of the proceeds remained traceable, 28% had gone dark and 4% had been frozen, with most of the stolen Ethereum converted to Bitcoin via Thorchain and pushed through mixers including Wasabi, Tornado Cash and Railgun. In June, Greek authorities traced a portion of the money to a wallet on a domestic exchange and issued a seizure order.
Bybit said the civil case runs alongside criminal investigations, and that it continues to share blockchain intelligence with agencies including the FBI. It pointed to Germany’s takedown of the eXch exchange and the disruption of Cryptomixer.io by German and Swiss authorities as evidence of that cooperation. The proceedings are ongoing.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.