Crypto Exchange Bybit Files Civil Lawsuit Against North Korea Over $1.5 Billion Theft
Bybit secures a court order freezing identified stolen assets following a massive February 2025 breach.
Quick Look
Crypto exchange Bybit has filed a U.S. civil lawsuit against North Korea, its Reconnaissance General Bureau, and the Lazarus Group over a $1.5 billion theft in February 2025, securing a preliminary injunction to freeze identified stolen assets.
AI-generated summary
Why It Matters
Attackers drained roughly 500,000 ETH from a Bybit cold wallet in February 2025 by manipulating a signing interface.
Crypto exchange Bybit has filed a civil lawsuit against North Korea over the theft of $1.5 billion from the exchange in February 2025, and secured a court order freezing stolen assets that investigators have identified.
The suit, filed in the U.S. District Court for the District of Columbia, names the Democratic People's Republic of Korea, its Reconnaissance General Bureau and the Lazarus Group, the state-linked hacking outfit U.S. authorities blame for the attack. Unidentified individuals and entities holding or moving the funds are named as John Doe defendants.
A judge granted a preliminary injunction barring the transfer or dissipation of identified assets while the case proceeds, and found Bybit likely to succeed on the merits, the exchange said on Friday. In granting an earlier temporary restraining order, the court characterized the theft as among the biggest the industry has seen.
"It was an attack on trust in our industry," the firm's co-founder and CEO Ben Zhou said in a statement Thursday, adding that Bybit had worked with investigators, exchanges, regulators and law enforcement before turning to the courts.
Bybit said that around $48.4 million has been recovered and about $30.5 million frozen across more than 28 exchanges and custodians, together amounting to approximately 5% of what was taken.
Where the money went
Attackers drained roughly 500,000 ETH from a Bybit cold wallet in February 2025, after manipulating a signing interface that showed approvers the correct destination address while altering the wallet's underlying logic. Zhou said at the time that the exchange was solvent and could cover the loss.
By April, Zhou said some 69% of the proceeds remained traceable, 28% had gone dark and 4% had been frozen, with most of the stolen Ethereum converted to Bitcoin via Thorchain and pushed through mixers including Wasabi, Tornado Cash and Railgun. In June, Greek authorities traced a portion of the money to a wallet on a domestic exchange and issued a seizure order.
What to Watch
AI outlook — possibilities, not facts
Court proceedings will continue in the U.S. District Court for the District of Columbia.
Very likely · Within months
Open Questions
- Will Bybit successfully recover the remaining stolen funds?
- How will North Korea respond to the U.S. court order?
