Cryptocurrency exchange Bybit has launched a comprehensive legal offensive against North Korea and its notorious Lazarus Group over the $1.5 billion hack of its Ethereum wallet in February 2025. In a civil lawsuit filed in the U.S. District Court for the District of Columbia, Bybit targets the Democratic People’s Republic of Korea (DPRK), its Reconnaissance General Bureau, and the Lazarus Group, which U.S. authorities have linked to the attack. The court described the incident as "one of the largest cryptocurrency thefts in history."
As part of the proceedings, Bybit secured a preliminary injunction that freezes identified stolen assets held or moved by unidentified individuals and entities—named as John Doe defendants. The injunction prohibits any transfer or dissipation of those assets pending further litigation. The court found that Bybit had "demonstrated a likelihood of success on the merits" of its claims. CEO Ben Zhou stressed that the company’s focus is on protecting users, recovering funds, and holding the attackers accountable, calling the Lazarus attack "an assault on trust in our industry."
To date, approximately $48.4 million in stolen assets have been recovered, and over $30.5 million frozen across more than 28 cryptocurrency exchanges and custodians. Bybit has collaborated with blockchain analytics firms, law enforcement agencies—including the FBI—and international partners. Notably, German authorities dismantled exchange eXch and, together with Swiss counterparts, took action against Cryptomixer.io as part of laundering disruption efforts.
In a parallel development, Bybit obtained U.S. court approval for expedited discovery, allowing the exchange to demand critical information from U.S.-based entities faster than normal. This procedural win targets account holder identities and transaction records from exchanges where traceable assets may have flowed, significantly accelerating the investigation. The case, originally filed under seal in June 2025 alongside 20 John Doe defendants, highlights the growing intersection of crypto and national security, potentially setting a precedent for how exchanges pursue cross-border cybercrime.
