Bybit sues North Korea over $1.5 billion hack, secures court-backed asset freeze

Cryptocurrency exchange Bybit has filed a civil lawsuit in the U.S. against North Korea, its Reconnaissance General Bureau, and the Lazarus Group over a $1.5 billion hack in February 2025. Bybit secured a preliminary injunction and expedited discovery from a federal court to trace and freeze the stolen assets. Although 90.2% of the funds have become untraceable through mixers and bridges, Bybit has successfully frozen or recovered approximately $75.5 million (5.3%) of the stolen Ethereum.

Bybit lawsuit against North Korea

• ▪In its civil lawsuit, cryptocurrency exchange Bybit is seeking the return of stolen assets, approximately $1.5 billion in compensatory damages, punitive damages, and treble damages under the U.S. Racketeer Influenced and Corrupt Organizations Act.
• ▪Cryptocurrency exchange Bybit is pursuing its civil action against North Korea independently of ongoing criminal investigations conducted by United States law enforcement authorities.
• ▪Cryptocurrency exchange Bybit filed a civil lawsuit in the U.S. District Court for the District of Columbia against the Democratic People's Republic of Korea, its Reconnaissance General Bureau intelligence agency, the Lazarus Group, and 20 unidentified defendants.

February 2025 Lazarus Group hack

• ▪The February 21, 2025 hack of cryptocurrency exchange Bybit occurred after attackers used compromised credentials belonging to a Safe developer to inject malicious code into Safe Wallet's cloud infrastructure.
• ▪The Federal Bureau of Investigation officially attributed the $1.5 billion theft from cryptocurrency exchange Bybit to North Korea on February 26, 2025.
• ▪On February 21, 2025, the North Korean state-sponsored Lazarus Group allegedly stole approximately $1.5 billion in Ethereum, totaling over 400,000 ETH and stETH, from Dubai-based cryptocurrency exchange Bybit.

Court-ordered preliminary injunction

• ▪A United States federal court granted cryptocurrency exchange Bybit a preliminary injunction prohibiting unidentified defendants from transferring or selling identified stolen assets connected to the $1.5 billion hack.
• ▪The United States District Court issued a temporary restraining order on June 19, 2026, renewed it on July 16, 2026, and partially granted cryptocurrency exchange Bybit's request for a preliminary injunction on July 30, 2026.

Expedited discovery for asset tracing

• ▪A United States federal judge granted cryptocurrency exchange Bybit expedited discovery on June 19, 2026, to identify alleged intermediaries and trace a portion of the $1.5 billion in stolen assets.
• ▪In its complaint, cryptocurrency exchange Bybit alleged that some traceable stolen assets reached exchanges operating in the United States, and sought account-holder identities, balances, and transaction histories from those platforms.

Frozen stolen cryptocurrency assets

• ▪The 9.8% of traceable funds as of June 18, 2026, represents a sharp drop from shortly after the February 2025 hack, when Bybit CEO Ben Zhou stated that 68.57% of the stolen funds were traceable.
• ▪As of June 18, 2026, only 9.8% of the stolen Bybit funds remained traceable, with 5.3% of the total, amounting to approximately $75.5 million, having been frozen or recovered.
• ▪As of June 18, 2026, cryptocurrency exchange Bybit stated that 90.2% of the stolen $1.5 billion had become untraceable after passing through mixers, cross-chain bridges, and over-the-counter dealers.

North Korean state-sponsored crypto theft

• ▪The $1.5 billion stolen from cryptocurrency exchange Bybit in February 2025 made up the bulk of the $2.02 billion in cryptocurrency stolen by North Korea during that year.
• ▪According to data from Chainalysis, North Korean hackers have stolen a total of $6.75 billion worth of cryptocurrency, which is widely believed to fund the country's weapons program.

2 sources