Bybit Launches Federal Lawsuit Against North Korea Over $1.5 Billion Theft
Cryptocurrency exchange Bybit has filed a civil lawsuit in U.S. federal court targeting North Korea and its state-linked hacking group over a $1.5 billion theft in February 2025, with a judge granting a preliminary injunction to freeze identified stolen assets.
Bybit Launches Federal Lawsuit Against North Korea Over $1.5 Billion Theft
In a landmark legal action targeting state-sponsored cybercrime, the cryptocurrency exchange Bybit has filed a civil lawsuit in U.S. federal court against North Korea, its Reconnaissance General Bureau, and the Lazarus Group for stealing $1.5 billion in February 2025. The filing represents an escalation in the crypto industry’s efforts to hold hostile state actors accountable for theft and fraud targeting digital asset platforms.
Court Victory and Asset Freezing
According to Bybit, the U.S. District Court for the District of Columbia has granted a preliminary injunction freezing assets that investigators identified as stolen. A judge concluded that Bybit was likely to succeed on the merits of the case and issued a temporary restraining order barring the transfer or dissipation of identified assets while litigation proceeds. The court characterized the theft as one of the largest the industry has faced, underscoring the severity of the breach.
The lawsuit names the Democratic People’s Republic of Korea, its state intelligence agency, and the Lazarus Group—the hacking organization that U.S. authorities have publicly attributed to the attack. Additional defendants identified as John Doe entities are also named for their roles in holding or moving the stolen funds.
The Breach and Laundering Trail
The theft involved approximately 500,000 Ethereum tokens drained from Bybit’s cold wallet. Attackers exploited a vulnerability in the exchange’s signing interface, manipulating it to display the correct destination address to approvers while secretly altering the wallet’s underlying logic to redirect funds elsewhere.
Bybit reports that recovery efforts have yielded approximately $48.4 million recovered and roughly $30.5 million frozen across more than 28 exchanges and custodians—together totaling approximately 5% of the stolen amount. Tracing the remaining funds has proven difficult due to sophisticated laundering techniques. According to Bybit, attackers converted most of the stolen Ethereum to Bitcoin through Thorchain before routing the proceeds through privacy mixers including Wasabi, Tornado Cash, and Railgun.
By April 2025, four months after the theft, approximately 69% of the proceeds remained traceable, 28% had disappeared from view, and 4% had been frozen by authorities. Greek officials traced a portion of the funds to a wallet on a domestic exchange and issued a seizure order, demonstrating the capacity of international law enforcement to interrupt the flow of stolen assets.
International Coordination and Ongoing Investigation
Bybit stated that the civil case runs parallel to ongoing criminal investigations, with the exchange sharing blockchain intelligence with federal agencies including the FBI. International law enforcement has demonstrated progress in disrupting the infrastructure supporting such theft, with Germany shutting down the eXch exchange and with German and Swiss authorities disrupting Cryptomixer.io.
Bybit co-founder and CEO Ben Zhou characterized the theft as “an attack on trust in our industry” and emphasized the company’s coordination with investigators, exchanges, regulators, and law enforcement before pursuing court action. Bybit said at the time of the hack that the exchange remained solvent despite the loss.
This precedent-setting case shows that international legal cooperation and law enforcement coordination can constrain major theft operations and establish accountability for nation-state actors targeting the crypto ecosystem.
Source: Bybit, via Decrypt. Not financial advice.