Bybit said on Friday that it has filed a civil lawsuit in the U.S. District Court for the District of Columbia against North Korea, the Democratic People’s Republic of Korea (DPRK), its Reconnaissance General Bureau (RGB), and the Lazarus Group, seeking to hold them liable for the large-scale cyberattack carried out against the exchange in February 2025.
The exchange said it has also secured a preliminary injunction from the court to freeze identified stolen digital assets held or transferred by unknown individuals and entities listed as “John Doe” defendants. In approving the initial temporary restraining order, the court described the matter as “one of the largest cryptocurrency thefts in history” and found that Bybit was likely to succeed on the merits of the case.
Civil case runs separately from criminal investigation
According to Bybit, the civil action is separate from an ongoing criminal investigation by U.S. law enforcement authorities. The company said the lawsuit is meant to open an additional judicial channel for recovering stolen assets. The civil case remains ongoing.
Recovery and freezing efforts
Bybit said its work with blockchain analytics firms, exchanges, custodians, and international law enforcement agencies has already produced results. As of now, the company said it has:
- recovered about $48.4 million in stolen assets;
- frozen about $30.5 million in related assets; and
- tracked those frozen assets across more than 28 exchanges and custodial institutions.
Broader enforcement actions
Bybit said those recovery efforts also supported wider law enforcement actions targeting infrastructure allegedly used to launder stolen funds. German authorities, it said, have dismantled the cryptocurrency exchange eXch. After that, German and Swiss authorities jointly took down the mixer platform Cryptomixer.io, which Bybit described as a key channel used to move illicit proceeds.
The company said the combined actions show that coordination between private-sector firms and law enforcement can produce concrete results in cross-border cybercrime cases.
Statement from Ben Zhou
Bybit co-founder and CEO Ben Zhou said: “Our core objective has never changed: protect users first, do everything possible to recover assets, and make sure those responsible are held legally accountable. Lazarus’s attack was not only directed at Bybit, but also challenged the baseline of trust across the entire crypto industry. We will continue to deepen cooperation with law enforcement agencies, regulators, and the courts, so that the crypto world becomes a place where criminals find it harder to hide.”
Bybit added that it will keep investing in advanced blockchain tracing technology and use every available legal tool against state-sponsored hacking groups, while pushing for a more resilient digital asset ecosystem.