Bybit, the world's second-largest cryptocurrency exchange by trading volume, has filed a civil lawsuit in U.S. federal court against North Korea, its Reconnaissance General Bureau, and the Lazarus Group over the February 2025 theft that a U.S. court described as "one of the largest cryptocurrency thefts in history."
The suit was filed under seal on June 18, 2026, in the U.S. District Court for the District of Columbia and became public this week. A judge granted a preliminary injunction on July 30 that bars the transfer or disposal of identified stolen assets while the case continues. In granting the order, the court found that Bybit had "demonstrated a likelihood of success on the merits" of its claims.
Legal claims were brought under RICO and the Computer Fraud and Abuse Act, as well as the Alien Tort Statute. Bybit is seeking the return of stolen funds and approximately $1.5 billion in compensatory damages, along with punitive and treble damages.
"Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable," said Ben Zhou, co-founder and CEO of Bybit. "The Lazarus attack wasn't just an attack on Bybit. It was an attack on trust in our industry. That's why we've worked closely with investigators, exchanges, regulators, law enforcement, and now the courts. We hope this marks another step toward making crypto a much harder place for criminals to operate in and a much safer place for everyone else."
How the attack unfolded
Attackers hit a Bybit cold wallet in February 2025 after they manipulated a signing interface that showed approvers the correct destination address while altering the wallet's underlying smart contract logic. About 500,000 ETH was taken. Zhou said at the time that the exchange was solvent and could cover the loss.
By April 2025, Zhou reported that approximately 69% of the stolen funds remained traceable on-chain. More than a quarter had gone dark, and about 4% had been frozen. Much of the stolen Ethereum was converted to Bitcoin via Thorchain before proceeds were pushed through mixers. In June 2025, Greek authorities traced a portion of the funds to a wallet on a domestic exchange and issued a seizure order.
What the lawsuit is actually aimed at
No U.S. court can compel North Korea to appear or hand over assets. The DPRK has never complied with international legal proceedings of this kind, and its government holds no assets subject to U.S. jurisdiction in any conventional sense.
The practical mechanism is different. The court granted Bybit expedited discovery, which allows the exchange to legally compel platforms and custodians to produce account identities, balances, and transaction records connected to the stolen funds. Some of that money moved through services with U.S. infrastructure. The John Doe defendant structure names unidentified individuals and entities that held or moved the funds, giving Bybit a legal path to pursue the middlemen who helped convert stolen crypto into accessible money.
Chainalysis estimates North Korea has stolen approximately $6.75 billion in cryptocurrency to date, with $2.02 billion taken in 2025 alone, a 51% increase year over year.
What has been recovered and what has not
Approximately $48.4 million in stolen assets has been recovered since the attack. A further $30.5 million has been frozen across more than 28 exchanges and custodians, pending further legal and investigative steps. Together those amounts represent roughly 5% of what was taken, and more than 90% of the stolen Ethereum remains untraceable.
The civil case runs parallel to criminal investigations conducted by U.S. authorities. Bybit said it continues to share blockchain intelligence with agencies including the FBI.
"The real test comes after the crisis," Zhou said. "That's when you show whether your commitment is real. For us, that means continuing to strengthen our security, working hand in hand with investigators and industry partners, and doing everything we can to protect our users. Trust isn't something you claim. You have to earn it through action, every single day."
Enforcement actions outside the courtroom
German authorities dismantled cryptocurrency exchange eXch, a platform Bybit cited as a channel used to move stolen proceeds. German and Swiss authorities later shut down Cryptomixer.io in a separate operation. Bybit said both outcomes reflect what coordinated effort between the private sector and law enforcement can produce.
The exchange said it intends to seek additional judicial relief as the Washington court proceedings advance.
Tanya Petrusenko
Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Please note that, despite the nature of much of the material created and hosted on this website, HODL FM operates as a media and informational platform, not a provider of financial advisory services. The opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice, HODL FM strongly recommends contacting a qualified industry professional.
