Crypto exchange Bybit has filed a civil lawsuit against North Korea in U.S. federal court over the theft of $1.5 billion from the platform in February 2025, securing a preliminary injunction that bars the movement or dissipation of stolen assets investigators have traced so far.
Suit Names DPRK, Reconnaissance Bureau, and Lazarus Group
The complaint, lodged in the U.S. District Court for the District of Columbia, names the Democratic People’s Republic of Korea, its Reconnaissance General Bureau, and the Lazarus Group, the state-linked hacking outfit that U.S. authorities have attributed the attack to. Unknown individuals and entities currently holding or moving the funds are listed as John Doe defendants.
According to the exchange, a judge granted a preliminary injunction blocking any transfer or depletion of the identified assets while the case continues, and found Bybit likely to succeed on the merits. In granting an earlier temporary restraining order, the court had characterised the theft as among the largest the crypto industry has ever seen.
‘It was an attack on trust in our industry,’ Bybit co-founder and CEO Ben Zhou said in a statement, adding that the exchange had worked with investigators, other exchanges, regulators, and law enforcement before turning to the courts.
Only About 5% of Stolen Funds Accounted For
Bybit disclosed that approximately $48.4 million has been recovered and roughly $30.5 million frozen across more than 28 exchanges and custodians. Together, those figures represent only around 5% of the total stolen.
Attackers drained roughly 500,000 ETH from a Bybit cold wallet in February 2025 by manipulating a signing interface that displayed the correct destination address to approvers while secretly altering the underlying wallet logic. Zhou said at the time that the exchange was solvent and could cover the loss.
By April 2025, Zhou reported that approximately 69% of the stolen proceeds remained traceable on-chain, 28% had gone dark, and 4% had been frozen. Most of the stolen Ethereum was converted to Bitcoin using the Thorchain bridge and then pushed through mixing services including Wasabi, Tornado Cash, and Railgun.
Law Enforcement Cooperation Cited
Bybit said the civil proceedings run in parallel with ongoing criminal investigations. The exchange continues to share blockchain intelligence with agencies including the FBI. It pointed to two recent enforcement actions as evidence of international coordination: Germany’s takedown of the eXch exchange, and the disruption of Cryptomixer.io by German and Swiss authorities.
In June 2025, Greek authorities traced a portion of the stolen funds to a wallet held on a domestic exchange and issued a seizure order.
