Bybit takes North Korea and Lazarus to court after a reported $1.5 billion hack
Bybit is turning a massive crypto theft into a legal fight. The exchange says it has filed a civil lawsuit in U.S. court against North Korea, its intelligence agency, and the Lazarus Group, while also securing an order to freeze identified stolen assets.
- Bybit filed in U.S. District Court for the District of Columbia over the February 2025 cyberattack.
- A court found Bybit had “demonstrated a likelihood of success on the merits” and issued a preliminary injunction.
- Bybit says about US$48.4 million has been recovered and over US$30.5 million has been frozen.
- The case targets alleged DPRK-linked cybercrime and the networks used to move stolen funds.
Bybit says the lawsuit names the Democratic People’s Republic of Korea, its Reconnaissance General Bureau, the Lazarus Group, and unidentified John Doe defendants linked to the February 2025 attack. U.S. authorities have previously attributed the Lazarus Group to North Korea, and Bybit says that group was responsible for the hack in question.
The exchange says the breach resulted in a $1.5 billion theft. In granting the initial temporary restraining order, the court described the incident as “one of the largest cryptocurrency thefts in history.” That is not just a headline-grabber. It is a reminder that crypto crime now operates at a scale that can embarrass entire compliance departments and keep risk teams awake for weeks.
Bybit says the court has now issued a preliminary injunction freezing identified stolen assets held by unidentified individuals and entities. In plain English, that means the court has ordered those assets not to be moved while the case continues. It does not mean the money is fully recovered. It means the door is being slammed before the thieves can sprint out the back window.
That distinction matters. A freeze preserves assets. Recovery happens later, if it happens at all.
Bybit co-founder and CEO Ben Zhou said:
“Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable, ”
He also said:
“The Lazarus attack wasn’t just an attack on Bybit. It was an attack on trust in our industry.”
There is no sugarcoating that. A hack of this size does not just hit one exchange’s balance sheet. It hits confidence in the entire sector, especially when the alleged attackers are tied to a state that has long been accused of using cyber theft as a revenue stream.
Bybit says the legal action is part of a broader effort that combines blockchain intelligence, international cooperation, and judicial remedies to recover funds and make crypto-related cybercrime harder to pull off. That is the right playbook: trace the money, freeze what can be frozen, and keep pressure on the infrastructure that criminals rely on.
According to Bybit, that effort has already produced some results. The company says approximately US$48.4 million in stolen assets has been recovered. It also says more than US$30.5 million has been frozen across more than 28 exchanges and custodians.
Those figures should be read carefully. Recovered funds are not the same thing as frozen funds. Frozen assets are preserved, but they are not yet back in Bybit’s hands. In crypto theft cases, that distinction is everything, because the difference between “tracked” and “returned” can be a court order, a foreign jurisdiction, or a laundering route nobody caught in time.
Bybit says the effort has also helped authorities move against services allegedly used to launder stolen funds. German authorities dismantled the cryptocurrency exchange eXch, and German and Swiss authorities later disrupted Cryptomixer.io. Those are not side quests. Once stolen crypto reaches mixers, exchanges, and custodial bottlenecks, recovery gets much harder and slower.
That is also where blockchain transparency cuts both ways. Public blockchains make it harder to pretend stolen funds never moved. Blockchain analytics firms can trace transaction paths, cluster addresses, and flag interactions with exchanges and services. But tracing is not the same as seizing. The chain may be public, but the people hiding behind it are rarely cooperative.
Bybit says it continues to cooperate with the FBI. That matters because civil litigation and criminal investigation serve different purposes, but they can reinforce each other. Civil action can preserve assets and build leverage. Criminal probes can identify operators, expose infrastructure, and create pressure points for seizures and sanctions. When both sides are moving, recovery odds improve. When they are not, the funds tend to disappear into the usual swamp of wallets, relays, and laundering services.
There is a broader geopolitical reality here too. North Korea has long been accused by governments and blockchain investigators of using cyber theft to generate revenue. If a state-linked group can hit a major exchange and move funds fast enough, the message to other criminals is ugly but clear: crypto is only as secure as the weakest custodial and operational link in the chain.
Bybit says it has more than 80 million users worldwide, which raises the stakes further. For a platform that large, trust is not a branding line. It is the product. If users think an exchange cannot defend them or respond effectively when disaster strikes, confidence can evaporate fast.
Zhou was blunt about what that trust demands:
“The real test comes after the crisis, ”
“That’s when you show whether your commitment is real.”
“Trust isn’t something you claim. You have to earn it through action, every single day.”
That is not wrong. A lot of crypto firms are happy to market resilience until they actually need to prove it. Then the excuses arrive, the statements get polished, and everyone suddenly discovers the joy of saying as little as possible. This case is the opposite: if Bybit really wants to show strength, the proof is in the recovery work, the transparency, and the follow-through.
The court’s early rulings give Bybit a procedural win, but they do not settle the case. The named and unnamed defendants still need to be pursued, the money trail still needs to be mapped, and the final recovery outcome is still uncertain. Even if the lawsuit succeeds, collecting across borders and against hidden actors is a very different fight from obtaining a court order.
Still, the message is clear. Crypto theft is not just a technical incident to be buried in a postmortem and forgotten by next quarter. It is a legal, operational, and sometimes geopolitical threat. And in a sector that likes to talk about decentralization and censorship resistance, the uncomfortable truth is that centralized chokepoints like exchanges, custodians, and laundering services remain the places where the real battles are won or lost.
Key questions and takeaways
-
What did Bybit do after the hack?
Bybit says it filed a civil lawsuit in the U.S. District Court for the District of Columbia and secured a preliminary injunction to freeze identified stolen assets while the case proceeds. -
Who is Bybit suing?
Bybit says the named defendants include North Korea, its Reconnaissance General Bureau, the Lazarus Group, and unidentified John Doe defendants linked to the stolen funds. -
How much was allegedly stolen?
Bybit says the February 2025 cyberattack resulted in a $1.5 billion theft. The court also described it as “one of the largest cryptocurrency thefts in history.” -
Has any of the money been recovered?
Yes. Bybit says approximately US$48.4 million has been recovered, and more than US$30.5 million has been frozen across more than 28 exchanges and custodians. -
Why does the injunction matter?
A preliminary injunction temporarily stops assets from being moved or dissipated. It helps preserve the funds while the legal process plays out, but it does not guarantee full recovery. -
Does this prove the full loss will be recovered?
No. It improves Bybit’s chances, but cross-border enforcement, laundering routes, and unidentified defendants make full recovery far from certain. -
Why does this case matter for crypto?
It shows that blockchain transparency can help trace stolen funds, but also that recovery depends on speed, legal action, and cooperation from exchanges, custodians, and law enforcement.
Further reading
For more on the laundering trail and the legal response, these pieces add useful context.
