Bybit, the world's second-largest cryptocurrency exchange by trading volume, has filed a civil lawsuit in the U.S. District Court for the District of Columbia against the Democratic People's Republic of Korea (DPRK), its Reconnaissance General Bureau (RGB), and the Lazarus Group — the DPRK-linked hacking organization that U.S. authorities have identified as responsible for the February 2025 cyberattack resulting in the theft of approximately $1.5 billion in digital assets. The Lazarus Group has been designated by the U.S. Treasury's Office of Foreign Assets Control (OFAC), and United Nations sanctions monitors have reported that North Korea's cryptocurrency theft operations serve as a significant revenue stream for the country's weapons programs.

The exchange has also secured a preliminary injunction freezing identified stolen assets currently held or moved by unidentified individuals and entities, who are named in the case as John Doe defendants. The court order is designed to preserve the identified stolen digital assets while litigation proceeds.

In granting the initial temporary restraining order, the court described the incident as "one of the largest cryptocurrency thefts in history." The court further found that "Bybit has demonstrated a likelihood of success on the merits" in its lawsuit. Suing a foreign state in U.S. courts typically faces significant hurdles under the Foreign Sovereign Immunities Act, though the DPRK was redesignated as a state sponsor of terrorism in 2017, which creates potential legal avenues for such claims.

While criminal investigations remain the responsibility of government authorities, the civil proceedings offer an additional legal avenue for preserving assets and protecting the interests of affected stakeholders.

Leadership Response

"Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable," said Ben Zhou, Co-founder and CEO of Bybit. "The Lazarus attack wasn't just an attack on Bybit. It was an attack on trust in our industry. That's why we've worked closely with investigators, exchanges, regulators, law enforcement, and now the courts. We hope this marks another step toward making crypto a much harder place for criminals to operate in and a much safer place for everyone else."

Strengthening Accountability Through Legal Action

The preliminary injunction prohibits the transfer or dissipation of identified assets connected to the case while litigation is ongoing. Bybit intends to seek additional judicial relief as the proceedings advance.

The civil action is being pursued independently of ongoing criminal investigations conducted by U.S. law enforcement authorities. Bybit continues to cooperate closely with relevant agencies, including the FBI, by sharing blockchain intelligence and investigative findings that may support broader enforcement efforts.

As digital assets increasingly become a target of sophisticated cross-border cybercrime, the company believes legal remedies, alongside criminal enforcement, can play an important role in preserving recoverable assets and strengthening accountability. Blockchain analytics firms including Chainalysis and TRM Labs have reported that North Korean hackers stole an estimated $1.3 billion to $1.4 billion in cryptocurrency in 2024 alone, making the regime one of the most prolific state-sponsored actors in the sector.

Global Collaboration Driving Asset Recovery

Since the February 2025 incident, Bybit has worked alongside blockchain analytics firms, exchanges, custodians, and international law enforcement agencies to trace stolen assets and disrupt laundering networks.

Recovery efforts to date include:

• Approximately US$48.4 million in stolen assets has been recovered.
• Over approximately US$30.5 million has been frozen across more than 28 exchanges and custodians, pending further legal and investigative action.

The combined recovered and frozen amounts represent roughly 5% of the total stolen, underscoring the difficulty of tracing and recovering digital assets once they move through cross-border laundering infrastructure.

These efforts have also supported broader enforcement actions targeting infrastructure allegedly used to launder stolen funds. Authorities in Germany dismantled the cryptocurrency exchange eXch, while German and Swiss authorities later disrupted Cryptomixer.io, removing key channels used to move illicit proceeds.

"The real test comes after the crisis," Ben Zhou added. "That's when you show whether your commitment is real. For us, that means continuing to strengthen our security, working hand in hand with investigators and industry partners, and doing everything we can to protect our users. Trust isn't something you claim. You have to earn it through action, every single day."

Building a More Resilient Digital Asset Ecosystem

The legal proceedings represent one component of Bybit's broader commitment to improving security standards across the cryptocurrency industry. The company continues to invest in advanced blockchain intelligence capabilities, deepen cooperation with exchanges and regulators, and support initiatives aimed at making digital asset theft increasingly difficult, traceable, and costly for criminal organizations.

This action reflects Bybit's commitment to holding state-sponsored threat actors accountable and using all available legal avenues — both civil and in cooperation with law enforcement — to disrupt cybercrime targeting the digital asset industry.

The civil proceedings remain ongoing. Bybit will continue to cooperate with relevant authorities and provide updates as permitted by the court.

For media inquiries: [email protected]