Bybit's legal response to the February 2025 hack has moved into U.S. federal court, opening an additional avenue for asset recovery. The cryptocurrency exchange filed a civil lawsuit against the Democratic People's Republic of Korea (DPRK), its Reconnaissance General Bureau, and the Lazarus Group in the U.S. District Court for the District of Columbia. A federal judge granted a preliminary injunction covering identified stolen assets tied to unnamed defendants, blocking transfers, sales, or other dissipation while litigation proceeds.

Bybit says it has recovered approximately $48.4 million linked to the hack and frozen another $30.5 million across more than 28 exchanges and custodians. The combined total of roughly $78.9 million represents only a fraction of the original $1.5 billion loss. Most of the stolen cryptocurrency remains under active tracing efforts.

Bybit CEO Ben Zhou announced the development on X:

Since the Lazarus attack in February 2025, Bybit has been working on recovery from every possible angle. Today, we took another step forward. Bybit has filed a civil lawsuit against the DPRK and the Lazarus Group, and secured a preliminary injunction freezing identified stolen… — Ben Zhou (@benbybit) August 8, 2026

Federal Lawsuit Targets DPRK, Reconnaissance General Bureau, and Lazarus Group

The complaint names the DPRK, the Reconnaissance General Bureau, and the Lazarus Group as defendants, along with unidentified individuals and entities accused of holding or moving stolen crypto. The lawsuit aims to preserve recoverable digital assets while Bybit pursues its claims through the federal civil process. Suing a foreign nation-state in a U.S. court involves navigating sovereign immunity doctrines, though existing U.S. sanctions designations against the DPRK, the Reconnaissance General Bureau, and Lazarus Group may shape the jurisdictional framework.

The preliminary injunction applies to identified assets connected with the unnamed, or John Doe, defendants. Bybit says the order prevents transfers or dissipation while the case develops. The court also found that the exchange had demonstrated a likelihood of success on the merits at this stage, though the order does not determine final ownership or complete the recovery process.

The Bybit hack occurred on February 21, 2025, when attackers compromised the user interface of a Safe (formerly Gnosis Safe) wallet used for Bybit's Ethereum cold storage, tricking signers into approving a transaction that redirected nearly $1.5 billion in ether to attacker-controlled addresses. Chainalysis has described the incident as the largest digital heist in cryptocurrency history.

Bybit emphasized that the civil lawsuit does not replace criminal investigations being conducted by U.S. authorities. The exchange continues to share blockchain intelligence and investigative findings with agencies including the FBI, and collaborates with analytics firms, exchanges, custodians, and international law enforcement partners.

North Korean Crypto Theft Reached $2.02 Billion in 2025

Chainalysis estimates that North Korean hackers stole at least $2.02 billion in cryptocurrency during 2025, a 51% increase from 2024. This pushed the group's estimated cumulative theft to $6.75 billion. The Bybit hack accounted for the majority of that annual total. The trend underscores how state-sponsored actors have increasingly targeted centralized exchanges and cross-chain bridges as primary vectors, with prior high-profile incidents including the Ronin Network hack and Harmony Bridge exploit.

The Lazarus Group has employed multiple laundering routes following major cryptocurrency thefts. Chainalysis has documented bridge services, mixing protocols, and smaller transaction tranches as hallmarks of North Korean laundering patterns. These methods spread stolen crypto across numerous addresses and networks, complicating recovery.

Enforcement Actions Target Laundering Infrastructure

Bybit notes that enforcement actions have also targeted services allegedly used to move illicit proceeds. German authorities dismantled the eXch cryptocurrency exchange, while German and Swiss authorities subsequently disrupted Cryptomixer.io. Bybit links those actions to broader efforts against laundering infrastructure connected with stolen funds. These disruptions reflect a growing pattern of law enforcement targeting intermediary services rather than individual wallet addresses, as sanctions and takedowns of mixers such as Tornado Cash have demonstrated.

Freezing stolen crypto does not automatically return it to an exchange. Investigators must identify assets, establish links to the theft, and coordinate with platforms holding the funds. Court orders can then restrict movement while ownership and recovery questions proceed through legal channels.

Bybit says it will seek additional judicial relief as the case advances, including further requests involving assets already identified through tracing work. The preliminary injunction currently covers identified assets held or moved by John Doe defendants named in the lawsuit. Bybit continues tracing wallets, transactions, exchanges, custodians, and services connected with the stolen crypto as the federal case remains active.