Bybit Files Federal Lawsuit Against North Korea, Freezes Stolen Crypto

• Bybit filed a civil suit against North Korea, its intelligence bureau, and the Lazarus Group over the $1.5 billion hack from last year.
• A U.S. federal court granted an injunction freezing assets tied to unidentified holders of the stolen funds.
• The case moves forward alongside a separate criminal investigation already underway with U.S. authorities.

Bybit filed a civil lawsuit in the U.S. District Court for the District of Columbia against North Korea, its Reconnaissance General Bureau intelligence agency, and the Lazarus Group, the hacking outfit blamed for draining $1.5 billion from the exchange in February 2025.

Along with the filing, the exchange secured a preliminary injunction. A federal judge ordered a set of unnamed defendants listed in the case as John Does to stop moving or selling assets connected to the stolen funds while the litigation proceeds.

The February 2025 breach pulled more than 400,000 ETH and staked ETH out of the Dubai-based exchange and stands as the largest crypto theft on record. It accounted for most of the roughly $2 billion North Korea stole in digital assets that year alone. Blockchain analytics firm Chainalysis puts the country’s total crypto haul at $6.75 billion, funds researchers believe help finance its weapons programs.

Civil Case Moves on a Separate Track From the Criminal Probe

Bybit noted that its civil case doesn’t replace the criminal investigation U.S. authorities are already running into the hack; the two are proceeding side by side. The company said the injunction is meant to preserve what remains of the stolen assets while it keeps working with regulators, other exchanges, and investigators to trace where the funds moved.

CEO Ben Zhou tied the filing to a wider industry concern. “The Lazarus attack wasn’t just an attack on Bybit,” he said in a statement, describing it as a strike against trust across the industry.

What Freezing Funds Actually Accomplishes

Litigating against a sanctioned government rarely produces a courtroom appearance, and North Korea has no real reason to show up and answer the complaint. What the injunction does is narrower than a courtroom win, but arguably more useful in practice. It makes it harder for whoever currently holds traceable stolen funds to cash out quietly, regardless of whether Pyongyang ever responds to the suit.

That distinction matters because criminal cases against North Korean state hackers rarely end in arrests, since the individuals involved sit outside U.S. jurisdiction. A civil case built around asset freezes gives investigators a different lever to pull: choke off liquidity by targeting whoever holds or moves the funds, instead of chasing people the U.S. can’t extradite.

Bybit said it intends to seek further relief from the court as the case develops, and that fund-recovery efforts continue in parallel with the litigation.

Sources:

Chainalysis: North Korea Drives Record $2B Crypto Theft Year, Pushing All-Time Total to $6.75B