Bybit has sued North Korea, its intelligence company and the Lazarus Group in a U.S. federal courtroom because the trade seeks to recuperate belongings stolen within the report $1.5 billion crypto hack.
Abstract
- Bybit filed its case towards North Korea, the RGB and Lazarus Group in Washington, D.C.
- A federal choose issued a preliminary injunction freezing sure stolen belongings held by unidentified defendants.
- The FBI beforehand attributed the $1.5 billion February 2025 assault to North Korean actors.
- Bybit stated the civil case stays separate from ongoing U.S. legal investigations.
Bybit takes Lazarus Group to US courtroom
Bybit filed the civil lawsuit within the U.S. District Court docket for the District of Columbia, naming the Democratic Folks’s Republic of Korea, its Reconnaissance Basic Bureau intelligence company and the Lazarus Group as defendants.
The case considerations the Feb. 21, 2025, breach that drained greater than 400,000 Ether (ETH) and staked Ether from the Dubai-based trade. The belongings had been valued at about $1.5 billion on the time, making the incident the biggest recorded cryptocurrency theft.
The FBI attributed the assault to North Korea shortly after the breach. U.S. authorities monitor the actors concerned below the title TraderTraitor and urged exchanges, validators and blockchain companies to dam transactions linked to addresses recognized within the laundering operation.
Bybit co-founder and CEO Ben Zhou stated the trade had labored with investigators, regulators, different buying and selling platforms and regulation enforcement businesses because the assault.
“Our focus has by no means modified: shield our customers first, recuperate what we are able to, and ensure the folks behind these assaults are held accountable,” Zhou stated.
Court docket freezes belongings linked to Bybit hack
Alongside the lawsuit, Bybit secured a preliminary injunction overlaying sure stolen belongings held by unidentified people and entities listed as John Doe defendants.
The order prevents these defendants from transferring, promoting or in any other case disposing of the recognized belongings whereas the litigation continues. A preliminary injunction preserves property throughout a case however doesn’t signify a closing ruling on legal responsibility or possession.
Bybit stated it might search additional reduction because the lawsuit progresses. The corporate is pursuing the civil declare individually from legal investigations being performed by U.S. regulation enforcement businesses.
The order provides Bybit one other path to pursue the stolen funds after months of counting on blockchain tracing, voluntary freezes by business members and a bounty program for data resulting in recoveries.
Stolen funds turned tougher to hint
Crypto.information reported in March 2025 that 88.87% of the stolen funds remained traceable, whereas 7.59% had gone darkish and three.54% had been frozen.
The traceable share later declined because the attackers transformed belongings into Bitcoin and dispersed them throughout hundreds of wallets. By April 2025, Zhou stated 27.6% of the stolen funds might now not be tracked.
Lazarus-linked wallets used providers together with cross-chain protocols and crypto mixers to make the transaction path tougher to observe. Bybit beforehand supplied rewards to platforms and investigators that helped determine or freeze the funds.
The trade additionally lined the shortfall following the assault via Ether purchases, loans and deposits from business counterparties, permitting it to proceed processing buyer withdrawals.
Lawsuit provides to US motion towards North Korean hackers
The case provides Bybit entry to a U.S. civil course of whereas federal businesses proceed investigating North Korea’s crypto operations. Any restoration will rely upon whether or not the defendants, exchanges or custodians controlling the recognized belongings adjust to the courtroom order.
North Korean teams stole an estimated $2.02 billion in cryptocurrency throughout 2025, in line with Chainalysis knowledge beforehand lined by crypto.information. The Bybit assault accounted for many of that quantity and pushed the nation’s estimated cumulative crypto theft to about $6.75 billion.
The risk continued into 2026. As reported by crypto.information, Lazarus-linked assaults allegedly drained one other $577 million from Drift Protocol and KelpDAO in April.
Bybit’s subsequent step might be looking for everlasting reduction and trying to recuperate the belongings lined by the injunction. The courtroom has not but issued a closing judgment within the civil case.
