Crypto exchange Bybit has filed a civil lawsuit against North Korea over the theft of $1.5 billion from the exchange in February 2025 and has already secured a court order freezing stolen assets that investigators have identified.
The complaint was filed in the U.S. District Court for the District of Columbia. It names the Democratic People’s Republic of Korea, its Reconnaissance General Bureau, and Lazarus Group, the state-linked hacking organization that U.S. authorities blame for the attack. Unidentified individuals and entities alleged to be holding or moving the funds were included as John Doe defendants.
Bybit said Friday that a judge granted a preliminary injunction preventing the transfer or dissipation of identified assets while the case proceeds. The exchange also said the court found Bybit likely to succeed on the merits. In an earlier temporary restraining order, the court described the theft as one of the largest the crypto industry has seen.
Recovered and frozen funds
According to Bybit, about $48.4 million has been recovered and roughly $30.5 million has been frozen across more than 28 exchanges and custodians. Combined, that amounts to approximately 5% of the funds taken in the hack.
In a statement issued Thursday, co-founder and CEO Ben Zhou said, 「It was an attack on trust in our industry,」 adding that Bybit worked with investigators, exchanges, regulators, and law enforcement before taking the matter to court.
How the 500,000 ETH was taken
Bybit said the attackers drained roughly 500,000 ETH from a cold wallet in February 2025. The theft happened after a signing interface was manipulated so that approvers were shown the correct destination address while the wallet’s underlying logic was altered. Zhou said at the time that the exchange remained solvent and could absorb the loss.
Tracing the stolen proceeds
By April, Zhou said around 69% of the proceeds remained traceable, 28% had gone dark, and 4% had been frozen. Bybit said most of the stolen Ethereum was converted into Bitcoin through Thorchain and then moved through mixers including Wasabi, Tornado Cash, and Railgun.
In June, Greek authorities traced part of the money to a wallet at a domestic exchange and issued a seizure order.
Civil case runs alongside criminal probes
Bybit said the civil action is moving forward in parallel with criminal investigations and that it continues to share blockchain intelligence with agencies including the FBI. The exchange pointed to Germany’s takedown of the eXch exchange and the disruption of Cryptomixer.io by German and Swiss authorities as examples of that cooperation.
The proceedings are ongoing.