Bybit, the world's second-largest cryptocurrency exchange by trading volume, has filed a civil lawsuit in the U.S. District Court for the District of Columbia against the Democratic People's Republic of Korea (DPRK), its Reconnaissance General Bureau (RGB), and the Lazarus Group — the DPRK-linked hacking organization that U.S. authorities have identified as responsible for the February 2025 cyberattack resulting in the theft of approximately $1.5 billion in digital assets from the exchange's Ethereum cold wallet.

The exchange has also secured a preliminary injunction freezing identified stolen assets currently held or moved by unidentified individuals and entities, designated in the case as John Doe defendants. The court order is designed to preserve the identified stolen digital assets while litigation proceeds, marking a significant step in Bybit's recovery efforts, its support for international law enforcement investigations, and its push for accountability in large-scale cybercrime.

In granting the order, the court found that "Bybit has demonstrated a likelihood of success on the merits" of its claims. When issuing the initial temporary restraining order, the court described the incident as "one of the largest cryptocurrency thefts in history."

The civil action forms part of a broader strategy that combines blockchain intelligence, international cooperation, and judicial remedies to pursue the actors behind the attack. While criminal investigations remain the responsibility of government authorities, the civil proceedings offer an additional mechanism for preserving assets and protecting affected stakeholders. The lawsuit follows a legal playbook used in prior crypto recovery cases, including the 2023 DOJ seizure of funds stolen by Lazarus from the Ronin Bridge, where court-ordered asset freezes helped recover a portion of stolen proceeds.

"Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable," said Ben Zhou, Co-founder and CEO of Bybit. "The Lazarus attack wasn't just an attack on Bybit. It was an attack on trust in our industry. That's why we've worked closely with investigators, exchanges, regulators, law enforcement, and now the courts. We hope this marks another step toward making crypto a much harder place for criminals to operate in and a much safer place for everyone else."

Strengthening Accountability Through Legal Action

The preliminary injunction prohibits the transfer or dissipation of identified assets connected to the case for the duration of the litigation. Bybit has indicated it will seek further judicial relief as the proceedings advance.

The civil case is being pursued independently of ongoing criminal investigations led by U.S. law enforcement authorities. Bybit continues to cooperate closely with relevant agencies, including the FBI, by sharing blockchain intelligence and investigative findings that may support broader enforcement actions.

As digital assets increasingly become targets of sophisticated cross-border cybercrime, the company believes that legal remedies — alongside criminal enforcement — can play an important role in preserving recoverable assets and strengthening accountability. United Nations expert panels have reported that DPRK-linked actors have stolen an estimated billions in cryptocurrency over recent years, with proceeds allegedly funneled into the country's weapons development programs under international sanctions. Holding state-sponsored actors to account through civil courts remains legally complex, as sovereign immunity doctrines and the DPRK's isolation from the international financial system limit practical enforcement avenues.

Global Collaboration Driving Asset Recovery

Since the February 2025 incident, Bybit has worked alongside blockchain analytics firms, exchanges, custodians, and international law enforcement agencies to trace stolen assets and disrupt laundering networks. To date, the following milestones have been achieved:

• Approximately US$48.4 million in stolen assets has been recovered.
• Over approximately US$30.5 million has been frozen across more than 28 exchanges and custodians, pending further legal and investigative action.

These efforts have also supported broader enforcement actions targeting infrastructure allegedly used to launder stolen funds. Authorities in Germany dismantled the cryptocurrency exchange eXch, while German and Swiss authorities later disrupted Cryptomixer.io, removing key channels used to move illicit proceeds. Together, these actions illustrate the impact of cooperation between the private sector and law enforcement in combating transnational cybercrime. The combined recovered and frozen totals represent roughly 5% of the stolen amount, underscoring the difficulty of tracing and clawing back digital assets once they are laundered through cross-chain bridges, mixers, and decentralized exchanges.

"The real test comes after the crisis," Zhou added. "That's when you show whether your commitment is real. For us, that means continuing to strengthen our security, working hand in hand with investigators and industry partners, and doing everything we can to protect our users. Trust isn't something you claim. You have to earn it through action, every single day."

Building a More Resilient Digital Asset Ecosystem

The legal proceedings represent one component of Bybit's broader commitment to improving security standards across the cryptocurrency industry. The company continues to invest in advanced blockchain intelligence capabilities, deepen cooperation with exchanges and regulators, and support initiatives aimed at making digital asset theft increasingly difficult, traceable, and costly for criminal organizations.

This action reflects Bybit's commitment to holding state-sponsored threat actors accountable and using all available legal avenues — both civil and in cooperation with law enforcement — to disrupt cybercrime targeting the digital asset industry.

The civil proceedings remain ongoing. Bybit has stated it will continue to cooperate with relevant authorities and provide updates as permitted by the court.

For more details about Bybit, please visit Bybit Press. For media inquiries, contact: [email protected].

Source: Crypto Front News