Bybit has taken its fight over the February 2025 breach to a U.S. federal court, filing a civil lawsuit in Washington, D.C., against North Korea, its Reconnaissance General Bureau and the Lazarus Group over the alleged theft of roughly $1.5 billion in cryptocurrency. The court has granted a preliminary injunction freezing identified assets tied to unnamed John Doe defendants, giving Bybit a mechanism to prevent further transfers while it pursues recovery.
According to Bybit, the U.S. District Court for the District of Columbia found that the company had “demonstrated a likelihood of success on the merits,” the standard generally required for preliminary injunctive relief. The order restricts dealings in specified digital assets associated with the theft, rather than deciding the lawsuit’s ultimate claims.
The case is among the most consequential attempts by a cryptocurrency platform to use U.S. civil courts against an alleged state-backed hacking operation. Bybit’s immediate objective is asset preservation: cryptocurrency can move through numerous wallets, conversion services and custodial platforms in minutes, making court-ordered freezes most useful before funds are dispersed further.
court order targets identified wallets and holders
The lawsuit names the Democratic People’s Republic of Korea, the Reconnaissance General Bureau and the Lazarus Group, while also including unidentified individuals and entities as John Doe defendants. Such defendants allow a claimant to pursue legal action when it has traced assets or activity to particular addresses or accounts but has not yet identified the people controlling them.
Bybit said an earlier temporary restraining order characterized the episode as “one of the largest cryptocurrency thefts in history.” The preliminary injunction moves beyond that initial emergency measure, keeping the restrictions in place as the litigation proceeds.
The court order applies to identified stolen assets, not cryptocurrency generally. Its practical effect depends on whether wallet operators, custodians, stablecoin issuers and other entities that encounter those assets are subject to the court’s authority or choose to comply with the restrictions. The litigation could also provide a route for Bybit to request further discovery and asset-related orders if it can identify additional holders.
Bybit said it will seek further judicial relief as the case develops. A civil action can help preserve and recover property, while criminal authorities retain responsibility for investigating the alleged theft and pursuing criminal charges.
recovery efforts have produced $48.4 million
Bybit said it has recovered approximately $48.4 million in stolen assets since the incident and secured freezes on more than $30.5 million across over 28 exchanges and custodians. Those frozen amounts remain subject to further legal and investigative procedures.
The figures illustrate the difficult economics of pursuing a theft of this scale. The recovered and frozen assets represent only a limited portion of the $1.5 billion Bybit says was taken, but every restraint reduces the number of routes available to move proceeds into new wallets, tokens or cash-out channels.
The company said it has worked with blockchain analytics firms, custodians and international law-enforcement agencies to trace the funds. Blockchain transactions are publicly visible, but tracing does not automatically reveal who controls an address. The recovery process usually depends on linking on-chain movements to services that hold customer information, then obtaining cooperation or legal orders to prevent withdrawals.
Bybit also linked recent enforcement actions in Europe to the effort to disrupt laundering routes. It said German authorities dismantled the cryptocurrency exchange eXch, while German and Swiss authorities later disrupted Cryptomixer.io. Mixing services can pool and redistribute funds in ways that make transaction trails harder to follow, although blockchain investigators can often continue tracking activity through patterns, timing and service interactions.
civil case runs alongside criminal investigation
Bybit said the civil suit is separate from criminal investigations being handled by U.S. law enforcement, including cooperation with the Federal Bureau of Investigation through the sharing of blockchain intelligence and investigative findings.
That division is significant for the company’s recovery strategy. Criminal cases can involve seizures, prosecutions and international coordination, but they can take years to resolve. A civil injunction gives the victim an earlier tool to restrain specifically identified assets, even while authorities pursue the alleged perpetrators and their networks.
The suit also places pressure on intermediaries that may hold, process or encounter assets connected to the breach. For custodians and other service providers, a court order creates a clear legal basis to halt movement of identified funds rather than waiting for a final criminal case or a completed attribution assessment.
Bybit has not presented the injunction as a final recovery outcome. The order preserves assets that have already been identified, while the larger challenge remains tracing funds that have passed through multiple wallets, services and conversion routes.
north korean thefts remain a major cybercrime concern
Chainalysis estimated that North Korea-linked hackers stole $2.02 billion in cryptocurrency during 2025, pushing the group’s cumulative known thefts to about $6.75 billion. The blockchain analytics firm has repeatedly identified the Lazarus Group as one of the most active and sophisticated cybercrime operations targeting cryptocurrency businesses.
Bybit Chief Executive Officer Ben Zhou said about 90.2% of the funds from the February breach had become untraceable, while the remaining 9.8% had moved to known wallets. That distinction explains why the lawsuit centers on specifically identified assets and unknown holders rather than claiming immediate recovery of the full amount.
The civil case remains ongoing. Its near-term test will be whether the injunction helps Bybit preserve the assets it has located and obtain enough information about the John Doe defendants to connect wallet activity with real-world account holders or institutions.
Worried about exchange hacks? Learn how dedicated funds like the Toobit Shield Fund help protect users from extreme security incidents.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
