Key facts
- Bybit has sued North Korea, its Reconnaissance General Bureau, and the Lazarus Group in U.S. federal court.
- The lawsuit is over the theft of $1.5 billion from Bybit in February 2025.
- A judge granted a preliminary injunction freezing identified stolen assets.
- Approximately $48.4 million has been recovered and $30.5 million frozen across more than 28 exchanges and custodians.
Crypto exchange Bybit has filed a civil lawsuit in the U.S. District Court for the District of Columbia against North Korea, its Reconnaissance General Bureau, and the Lazarus Group, alleging their involvement in the theft of $1.5 billion in February 2025. A judge has granted a preliminary injunction to freeze identified stolen assets, finding Bybit likely to succeed on the merits of its case. The court had previously characterized the theft as one of the largest in the industry. Bybit's CEO, Ben Zhou, stated that the attack undermined trust in the industry and highlighted the exchange's collaboration with investigators, other exchanges, regulators, and law enforcement. To date, approximately $48.4 million has been recovered and $30.5 million frozen across more than 28 exchanges and custodians, representing about 5% of the total stolen funds. The attackers initially drained around 500,000 ETH from a Bybit cold wallet by manipulating a signing interface. While Bybit confirmed its solvency to cover the loss at the time, a significant portion of the stolen Ethereum was converted to Bitcoin via Thorchain and laundered through mixers like Wasabi, Tornado Cash, and Railgun. The civil case is proceeding alongside criminal investigations, with Bybit continuing to share blockchain intelligence with agencies such as the FBI.