Bybit Files US Federal Lawsuit Against North Korea Over $1.5 Billion Crypto Hack

TLDR

• Bybit filed a civil lawsuit in US federal court against North Korea, its Reconnaissance General Bureau, and the Lazarus Group over the February 2025 hack
• A federal judge granted expedited discovery, allowing Bybit to trace stolen funds through US-based platforms
• 90.2% of the stolen assets have become untraceable after passing through mixers and cross-chain bridges
• A preliminary injunction was issued, freezing certain stolen assets held by unidentified defendants
• Only 5.3% of the total stolen funds, around $75.5 million, have been frozen or recovered so far

---

Bybit has filed a civil lawsuit in the US District Court for the District of Columbia, naming North Korea, its Reconnaissance General Bureau, and the Lazarus Group as defendants. The case relates to the February 21, 2025 hack that drained over 400,000 Ether from the Dubai-based exchange, worth roughly $1.5 billion at the time.

BREAKING: 🇰🇵Bybit sues North Korea over the $1.5 billion Lazarus Group crypto heist.

A U.S. federal court granted a preliminary injunction freezing identified assets linked to the hack while the civil case proceeds. pic.twitter.com/gFsrTaOwST

— Coin Bureau (@coinbureau) August 7, 2026

The FBI attributed the attack to North Korean actors on February 26, 2025. US authorities track the group under the name TraderTraitor and have urged exchanges and blockchain firms to block transactions connected to addresses linked to the laundering operation.

Court Grants Bybit Key Legal Tools

Bybit filed the lawsuit under seal on June 18, 2026. A federal judge granted expedited discovery the following day. This gives Bybit the authority to request account holder identities, balances, and transaction histories from platforms with US operations.

The court also issued a temporary restraining order on June 19, preventing unidentified defendants from transferring traceable assets. That order was renewed on July 16, and a preliminary injunction was partially granted on July 30.

The preliminary injunction does not represent a final ruling. It is designed to preserve assets while the case continues.

Most Stolen Funds Now Untraceable

As of the June 18 filing, Bybit reported that 90.2% of the stolen assets had become untraceable. Attackers used mixers, cross-chain bridges, and over-the-counter dealers to obscure the trail.

The remaining 9.8% had been traced to identifiable wallets. Of that, 5.3% of the total, about $75.5 million, had been frozen or recovered.

This is a sharp drop from early in the investigation. Bybit CEO Ben Zhou said more than a year ago that 68.57% of the funds were still traceable. By April 2025, that figure had dropped to 27.6%.

The hack originated when attackers compromised Safe Wallet’s cloud infrastructure using credentials belonging to a Safe developer. Malicious code was injected, allowing the theft to take place.

Bybit says it covered customer withdrawals after the attack through Ether purchases, loans, and deposits from industry counterparties. The exchange continued normal operations throughout.

In the lawsuit, Bybit is seeking the return of stolen assets, approximately $1.5 billion in compensatory damages, punitive damages, and treble damages under the US Racketeer Influenced and Corrupt Organizations Act.

North Korean groups stole an estimated $2.02 billion in cryptocurrency during 2025, according to Chainalysis data. The Bybit attack made up the majority of that total, pushing North Korea’s estimated cumulative crypto theft to around $6.75 billion. In April 2026, Lazarus-linked attacks allegedly drained another $577 million from Drift Protocol and KelpDAO.

Bybit says the civil case is separate from ongoing US criminal investigations. The exchange says it will seek further relief as the case progresses.