Bybit Sues North Korea Over $1.5 Billion Crypto Heist, Secures Court Order to Freeze Stolen Assets

Cryptocurrency exchange Bybit has filed a civil lawsuit against North Korea, its Reconnaissance General Bureau (RGB), and the state-linked hacking group Lazarus Group over the $1.5 billion cyberattack that targeted the exchange in February 2025.

The lawsuit, filed in the U.S. District Court for the District of Columbia, seeks to recover funds stolen during what remains one of the largest cryptocurrency exchange hacks in history. The complaint also names unidentified individuals and entities believed to have received, transferred, or controlled the stolen assets as "John Doe" defendants.

Court Freezes Identified Stolen Assets

As part of the legal proceedings, the court granted a preliminary injunction preventing the transfer or dissipation of identified assets linked to the hack while the case moves forward.

According to Bybit, the court concluded that the exchange is likely to succeed on the merits of its claims. The injunction follows an earlier temporary restraining order in which the court reportedly described the incident as one of the largest thefts ever recorded in the digital asset industry.

Bybit co-founder and CEO Ben Zhou said the company pursued legal action after months of collaboration with blockchain investigators, exchanges, regulators, and law enforcement agencies.

"It was an attack on trust in our industry," Zhou said in a statement, emphasizing that the company continues working with global authorities to trace and recover the stolen assets.

Nearly $79 Million Recovered or Frozen

The exchange said it has so far recovered approximately $48.4 million and secured the freezing of an additional $30.5 million across more than 28 cryptocurrency exchanges and custodians.

Combined, those efforts account for roughly $78.9 million, representing about 5% of the total funds stolen during the attack.

Bybit noted that the civil lawsuit complements ongoing criminal investigations and that it continues sharing blockchain intelligence with agencies, including the Federal Bureau of Investigation (FBI).

How the Attack Unfolded

The February 2025 breach resulted in the theft of approximately 500,000 ETH from one of Bybit's cold wallets.

According to previous statements from the exchange, attackers manipulated the wallet's signing interface, displaying the correct destination address to transaction approvers while secretly altering the underlying transaction logic, allowing the funds to be redirected to wallets controlled by the attackers.

At the time of the incident, Zhou said Bybit remained fully solvent and capable of covering customer assets despite the unprecedented loss.

Investigators Continue Tracking the Funds

Blockchain investigations have shown that the stolen cryptocurrency was rapidly moved across multiple platforms to complicate recovery efforts.

Earlier this year, Zhou disclosed that roughly 69% of the stolen funds remained traceable, while 28% had effectively disappeared through privacy-enhancing services and cross-chain transactions. Approximately 4% had already been frozen at that stage.

Investigators believe much of the stolen Ethereum was converted into Bitcoin using THORChain before being routed through cryptocurrency mixing services, including Wasabi Wallet, Tornado Cash, and Railgun, in an effort to obscure transaction trails.

Recovery efforts have extended beyond the United States. In June 2025, Greek authorities traced a portion of the stolen assets to a wallet held on a domestic cryptocurrency exchange and issued a seizure order.

Bybit also pointed to recent international law enforcement actions, including the shutdown of the eXch exchange and the disruption of Cryptomixer.io by German and Swiss authorities, as examples of growing cooperation aimed at combating cryptocurrency-related financial crime.

A Test Case for Crypto Asset Recovery

The lawsuit marks one of the most significant legal actions taken by a cryptocurrency exchange against a nation-state over a cyberattack.

While only a small portion of the stolen assets has been recovered or frozen so far, the case illustrates the increasingly coordinated approach between private companies, blockchain analytics firms, regulators, and law enforcement agencies in pursuing large-scale crypto thefts.

As proceedings continue, the outcome could influence future efforts to recover digital assets stolen in cross-border cyberattacks and reinforce the role of civil litigation alongside criminal investigations in combating crypto-related financial crime.