Bybit Files Civil Suit Against North Korea Over $1.5 Billion Heist, Secures Asset Freeze Order
Table of Contents
You might want to know
Was a court able to freeze the stolen assets after the exchange alleged state-backed involvement?
What portion of the theft has been traced, recovered, or frozen so far?
Main Topic
Crypto exchange Bybit has initiated civil litigation in U.S. federal court against the Democratic People's Republic of Korea (North Korea), the country's Reconnaissance General Bureau, and the Lazarus Group, asserting responsibility for a February 2025 hack that allegedly removed approximately $1.5 billion in cryptocurrency from the platform. The complaint, filed in the U.S. District Court for the District of Columbia, also lists unnamed individuals and entities — referred to as John Doe defendants — who are alleged to have held or moved the stolen funds.
In response to the suit, a judge granted a preliminary injunction that prevents identified assets believed to be proceeds of the theft from being transferred or dissipated while the civil case proceeds. The court's order followed an earlier temporary restraining order and included a judicial determination that Bybit is likely to prevail on the merits at this stage. The court characterized the incident as among the largest thefts the cryptocurrency industry has experienced, highlighting its significance for market trust and platform security.
Bybit’s leadership framed the attack as an assault on confidence in the broader sector. The exchange's co-founder and CEO emphasized cooperation with law enforcement, regulators, other exchanges, and private investigators prior to seeking relief through the courts. Bybit reported ongoing collaboration with investigative bodies and said it continues to share blockchain intelligence with agencies, including the Federal Bureau of Investigation. The company also cited international law-enforcement actions — such as the disruption of illicit services and seizures carried out by German and Swiss authorities — as evidence of ongoing cross-border cooperation on related probes.
Operational details about the breach describe how attackers manipulated a signing interface associated with a Bybit cold wallet. The interface presented approvers with the expected destination address while the wallet's underlying logic was altered to redirect funds. The intruders reportedly drained roughly 500,000 ETH from the cold wallet in February 2025. Bybit affirmed the exchange remained solvent and capable of covering the resulting loss.
Following the theft, blockchain tracing efforts yielded varying levels of visibility into the movement of funds. Bybit reported that investigators had identified and recovered roughly $48.4 million and obtained freezes on about $30.5 million across more than 28 exchanges and custodial platforms — together representing approximately 5% of the total stolen value. Earlier public statements indicated that by April a majority of the proceeds remained traceable to some degree, with estimates that around 69% of the funds were still traceable, 28% had been moved out of public view, and 4% had already been frozen at that time.
A significant portion of the stolen Ethereum is reported to have been converted into Bitcoin through cross-chain services such as Thorchain, and subsequently funneled through cryptocurrency privacy tools and mixers including Wasabi, Tornado Cash and Railgun. Those steps complicate recovery by obscuring transaction trails, though law-enforcement seizures and exchange cooperation have produced partial reversals of transfers in some jurisdictions. For example, Greek authorities reportedly traced part of the proceeds to a wallet on a domestic exchange and issued a seizure order in June, illustrating that traditional legal mechanisms can sometimes be applied when funds touch regulated entities.
Bybit’s civil action runs in parallel with criminal investigations. The civil case seeks remedies including the freezing and recovery of misappropriated assets and is part of a broader strategy combining private legal action with public-law enforcement efforts. Bybit has emphasized that pursuing both civil and criminal channels increases the chances of disrupting illicit networks and reclaiming assets for victims. The exchange's public disclosures stress continued intelligence sharing with international agencies and highlight prior successful takedowns and disruptions as examples of how coordinated efforts can limit the movement of illegally obtained cryptocurrency.
Beyond immediate asset recovery, the litigation raises novel questions about holding a foreign state and state-affiliated actors civilly liable for cyber-enabled theft of digital assets. Suing a sovereign actor like North Korea involves complex issues of jurisdiction, sovereign immunity, and service of process, often requiring creative legal theories and extensive factual development. The preliminary injunction evidences a court willing to entertain such claims where plaintiffs present persuasive evidence tying specific assets to the alleged wrongdoing. However, final resolution on liability and full recovery will depend on the court’s adjudication on the merits as well as the practical ability to identify and seize assets that may be hidden or dispersed across jurisdictions and obfuscation services.
For the cryptocurrency industry, the case underscores both systemic vulnerabilities and the potential role of civil litigation as a tool to achieve accountability and recovery. The legal action also highlights the importance of improved security practices, enhanced on-chain monitoring, and stronger cooperative arrangements between exchanges, custodians, and law enforcement to reduce the effectiveness of similar attacks in the future.
Key Insights Table
| Aspect | Description |
|---|---|
| Alleged Perpetrators | North Korea, its Reconnaissance General Bureau and the Lazarus Group are named in Bybit's civil suit. |
| Amount Stolen | Approximately $1.5 billion in cryptocurrency was allegedly taken from a Bybit cold wallet. |
| Court Action | U.S. District Court granted a preliminary injunction freezing identified stolen assets pending litigation. |
| Recovery/Frozen | Around $48.4 million recovered and $30.5 million frozen across 28+ exchanges/custodians. |
| Money Movement | Funds were partly converted via Thorchain and routed through mixers like Wasabi, Tornado Cash, and Railgun. |
| Legal Complexity | Suing a foreign state raises jurisdictional and sovereign immunity challenges; asset tracing and enforcement remain difficult. |
Afterwards...
The case will proceed on parallel civil and criminal tracks, and its outcome could influence how exchanges, victims, and governments respond to large-scale crypto thefts linked to state actors. Continued international cooperation, improved on-chain tracking, and legal precedent from this litigation may incrementally improve the prospects for asset recovery and deterrence. Nevertheless, much of the stolen value remains obscured, underscoring ongoing challenges for investigators and the need for stronger preventive safeguards across the industry.
As proceedings move forward, stakeholders should watch for further court rulings, sanctions or enforcement actions, and additional seizures by international authorities that could shift the balance between traceability and obfuscation in cross-border crypto crime.
