Bybit sues North Korea over $1.5 billion crypto hack, wins court-ordered asset freeze

Dubai: Cryptocurrency exchange Bybit has sued North Korea, its Reconnaissance General Bureau and the Lazarus Group over the $1.5 billion cyberattack that hit the platform in February 2025, securing a preliminary injunction to freeze identified stolen assets while it pursues further recovery.

Bybit said in a statement on Tuesday that the civil lawsuit was filed in the US District Court for the District of Columbia and targets the Democratic People's Republic of Korea, its intelligence agency and Lazarus Group, which US authorities have linked to the attack.

The court order prevents identified assets connected to the case from being transferred or dissipated while the litigation continues, according to Bybit. Unidentified individuals and entities holding or moving the funds have been named as John Doe defendants.

The company said the court found that “Bybit has demonstrated a likelihood of success on the merits” when granting the preliminary injunction.

Millions recovered and frozen

The lawsuit adds a civil route to Bybit's wider effort to trace and recover funds from a theft that became one of the largest attacks on a cryptocurrency exchange.

Bybit said approximately $48.4 million in stolen assets has been recovered so far, while more than $30.5 million has been frozen across over 28 exchanges and custodians pending further legal and investigative action.

The company has worked with blockchain analytics firms, cryptocurrency exchanges, custodians and international law enforcement agencies since the February 2025 attack to track the movement of the stolen assets and disrupt attempts to launder them.

How the $1.5bn theft happened

The February 21, 2025 attack involved around 401,000 Ethereum tokens worth approximately $1.5 billion at the time.

Hackers compromised one of Bybit's suppliers and altered the digital wallet address being used for a transfer, leading the exchange to send the crypto assets to a wallet controlled by the attackers instead of its intended destination.

Bybit subsequently replenished the stolen assets through loans from investors and began efforts to trace the funds across public blockchain networks.

The company also launched its Lazarus Bounty programme, encouraging participants to identify the movement of stolen crypto and help exchanges and other services freeze assets linked to the theft.

Civil case runs alongside criminal investigations

Bybit said the lawsuit is being pursued independently of criminal investigations being handled by US law enforcement agencies.

The exchange continues to cooperate with authorities including the FBI, sharing blockchain intelligence and investigative findings that could support enforcement activity.

Legal action gives the company another way to preserve assets identified during the tracing process while criminal investigations continue.

Bybit said authorities in Germany have dismantled cryptocurrency exchange eXch, while German and Swiss authorities later disrupted Cryptomixer.io, two services the company said were linked to channels used for moving illicit proceeds.

The exchange said it plans to seek further judicial relief while continuing to invest in blockchain intelligence and work with regulators, exchanges and law enforcement agencies.

The civil proceedings remain ongoing, with Bybit saying it will continue to cooperate with authorities and provide further updates where permitted by the court.