Bybit, the world's second-largest cryptocurrency exchange by trading volume, has filed a civil lawsuit in the U.S. District Court for the District of Columbia against the Democratic People's Republic of Korea (DPRK), its Reconnaissance General Bureau (RGB), and the Lazarus Group — the DPRK-linked hacking collective that U.S. authorities have identified as responsible for the February 2025 cyberattack resulting in the theft of approximately $1.5 billion in digital assets.

The theft, which targeted Bybit's Ethereum cold wallet, has been widely recognized as the largest cryptocurrency heist on record, surpassing previous industry benchmarks. The Lazarus Group, previously sanctioned by the U.S. Treasury Department and linked to a string of high-profile crypto exploits, operates as part of Pyongyang's state-backed cyber apparatus. United Nations investigators have documented that North Korea increasingly relies on cryptocurrency theft as a revenue stream to fund its sanctioned weapons programs, making the case a test of whether civil litigation can meaningfully complement criminal enforcement against state actors.

The exchange has also secured a preliminary injunction freezing identified stolen assets currently held by unnamed individuals and entities, referred to in the case as John Doe defendants. The court order is designed to preserve the identified digital assets while litigation is ongoing, marking a significant step in Bybit's broader campaign to recover stolen funds, assist international law enforcement investigations, and reinforce accountability for large-scale cybercrime.

In granting the injunction, the court determined that "Bybit has demonstrated a likelihood of success on the merits" of its claims. When issuing the initial temporary restraining order, the court described the incident as "one of the largest cryptocurrency thefts in history."

The civil action operates as a parallel track to ongoing criminal investigations led by government authorities. Bybit is cooperating closely with relevant agencies, including the FBI, by sharing blockchain intelligence and investigative findings that may support broader enforcement efforts.

"Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable," said Ben Zhou, Co-founder and CEO of Bybit. "The Lazarus attack wasn't just an attack on Bybit. It was an attack on trust in our industry. That's why we've worked closely with investigators, exchanges, regulators, law enforcement, and now the courts. We hope this marks another step toward making crypto a much harder place for criminals to operate in and a much safer place for everyone else."

Court Order Preserves Identified Assets During Litigation

The preliminary injunction prohibits the transfer or dissipation of identified assets connected to the case while the proceedings continue. Bybit indicated it intends to seek additional judicial relief as the case advances.

While the civil proceedings are being pursued independently of criminal investigations conducted by U.S. law enforcement, the company views legal remedies as an important complement to criminal enforcement in preserving recoverable assets and strengthening accountability, particularly as digital assets become an increasingly frequent target of sophisticated cross-border cybercrime. The outcome of the case may set a precedent for how victimized exchanges use U.S. courts to pursue state-linked actors that have historically operated beyond the reach of traditional law enforcement.

Global Collaboration on Asset Recovery

Since the February 2025 incident, Bybit has collaborated with blockchain analytics firms, exchanges, custodians, and international law enforcement agencies to trace stolen assets and disrupt laundering networks.

Recovery efforts to date include:

• Approximately US$48.4 million in stolen assets recovered.
• Over approximately US$30.5 million frozen across more than 28 exchanges and custodians, pending further legal and investigative action.

These initiatives have also supported broader enforcement actions targeting infrastructure allegedly used to launder stolen funds. Authorities in Germany dismantled the cryptocurrency exchange eXch, while German and Swiss authorities subsequently disrupted Cryptomixer.io, eliminating key channels used to move illicit proceeds.

"The real test comes after the crisis," Zhou added. "That's when you show whether your commitment is real. For us, that means continuing to strengthen our security, working hand in hand with investigators and industry partners, and doing everything we can to protect our users. Trust isn't something you claim. You have to earn it through action, every single day."

Broader Industry Commitment

The legal proceedings represent one component of Bybit's wider commitment to improving security standards across the cryptocurrency industry. The company continues to invest in advanced blockchain intelligence capabilities, deepen cooperation with exchanges and regulators, and support initiatives aimed at making digital asset theft increasingly difficult, traceable, and costly for criminal organisations.

The civil proceedings remain ongoing. Bybit has stated it will continue to cooperate with relevant authorities and provide updates as permitted by the court.