Bybit filed a civil lawsuit against North Korea over the February 2025 theft of roughly $1.5 billion in ether. It also won a preliminary injunction freezing traced assets. The exchange announced both moves Thursday.
The complaint landed in the U.S. District Court for the District of Columbia. Defendants include the Democratic People’s Republic of Korea, its Reconnaissance General Bureau, and the Lazarus Group, alongside unidentified individuals and entities holding the stolen funds. A federal judge granted the freeze and found Bybit “likely to succeed on the merits,” according to the exchange. The court had earlier issued a temporary restraining order, calling the theft “among the biggest the industry has seen.”
The numbers lay out the scale. Attackers drained roughly 500,000 ether (ETH) from a Bybit cold wallet on February 21, 2025. The method was surgical: they manipulated a signing interface that displayed the correct destination address to approvers while altering the wallet’s underlying logic. Bybit says it has recovered about $48.4 million and frozen another $30.5 million across more than 28 exchanges and custodians. Combined, roughly 5% of what was taken.
The rest is in motion. By April, CEO Ben Zhou said 69% of proceeds remained traceable, 28% had gone dark, and 4% had been frozen. Most of the stolen ether was converted to bitcoin via Thorchain, then pushed through mixers including Wasabi, Tornado Cash, and Railgun.
“It was an attack on trust in our industry,” Zhou said in a statement Thursday. “Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable.”
Bybit described the order as a step to “preserve identified stolen digital assets while the litigation continues,” and said it would seek further relief. The civil action runs independently of ongoing criminal investigations by U.S. law enforcement, the exchange said. Bybit continues to share blockchain intelligence with agencies including the FBI.
The lawsuit is a rare move. Exchanges seldom sue state-linked hacking operations directly. North Korea is widely believed to use stolen crypto to fund its weapons program, according to CoinDesk. The Bybit hack made up the bulk of the $2.02 billion in crypto stolen by North Korea in 2025. Total crypto stolen by the state to date: $6.75 billion, per Chainalysis data cited by the outlet.
Recovery has come in fragments. Greek authorities traced a portion of the money to a wallet on a domestic exchange in June and issued a seizure order. Bybit pointed to Germany’s takedown of the eXch exchange and the disruption of Cryptomixer.org by German and Swiss authorities as signs of cross-border cooperation building.
Dubai-based Bybit, described as the world’s second-largest cryptocurrency exchange, said at the time of the hack that it remained solvent and could cover the loss. Proceedings are ongoing. Whether North Korea or the Lazarus Group responds to the suit is not known. The specific legal claims invoked in the filing have not been disclosed in public reporting.
The figures differ slightly across sources on the stolen amount’s composition. Decrypt reported roughly 500,000 ETH. CoinDesk cited over 400,000 ETH and stETH. The dollar figure, approximately $1.5 billion, is consistent across both.
Holders, as ever, are divided.
