Bybit filed a civil lawsuit in the U.S. District Court for the District of Columbia against the Democratic People's Republic of Korea, its Reconnaissance General Bureau, and the Lazarus Group over the February 2025 cyberattack that drained $1.5 billion from the exchange. The court has already granted a preliminary injunction freezing identified stolen assets, and Bybit says it has clawed back roughly $48.4 million so far.
The $1.5 billion heist
The attack, described by the court as 'one of the largest cryptocurrency thefts in history,' hit Bybit in February 2025. In the lawsuit, the court found that 'Bybit has demonstrated a likelihood of success on the merits' — a key hurdle for any plaintiff seeking emergency relief. The case names the DPRK, its spy agency, and the Lazarus Group directly, alongside unnamed individuals and entities holding the stolen funds.
What the injunction does
The preliminary injunction freezes stolen assets held by those John Doe defendants, preventing them from moving or cashing out while the case proceeds. It's a civil tool that runs parallel to criminal investigations, which remain the job of government authorities. Bybit's legal action gives the exchange a direct way to preserve assets that might otherwise vanish through mixers or other laundering channels.
Recovery so far
Bybit says more than $30.5 million has been frozen across over 28 exchanges and custodians pending further legal and investigative action. On top of that, German authorities dismantled the exchange eXch, and German and Swiss authorities disrupted Cryptomixer.io — both key channels used to launder illicit proceeds from the hack. The takedowns cut off some of the easiest routes for moving stolen crypto, and Bybit has been working with the FBI and other U.S. law enforcement to share blockchain intelligence and investigative findings.
Why the lawsuit matters
Bybit CEO Ben Zhou put it bluntly: 'The Lazarus attack wasn't just an attack on Bybit. It was an attack on trust in our industry.' The lawsuit is part of a broader strategy that combines blockchain intelligence, international cooperation, and judicial remedies. While criminal prosecutions are up to governments, civil proceedings give exchanges a way to freeze assets and seek damages. Bybit says it will keep investing in blockchain intelligence and deepening ties with exchanges and regulators.
The case is ongoing, and the next concrete step is the court's handling of the frozen assets and the John Doe defendants. How much more Bybit can recover — and whether the DPRK ever responds in court — remains an open question.
