Bybit has filed a civil lawsuit in the US District Court for the District of Columbia against the Democratic People’s Republic of Korea, its Reconnaissance General Bureau, and the Lazarus Group, the state-linked hacking collective that US authorities say orchestrated a February 2025 cyberattack against the exchange. Alongside the filing, Bybit has secured a preliminary injunction freezing identified stolen assets held by unnamed defendants who have been moving or holding those funds.
The court, in granting an earlier temporary restraining order, described the incident as “one of the largest cryptocurrency thefts in history.” The district court has also found that “Bybit has demonstrated a likelihood of success on the merits,” a significant procedural milestone that bolsters the exchange’s position as the civil proceedings advance.
The legal strategy
The civil action runs in parallel with, but independently of, criminal investigations being conducted by US law enforcement. Bybit says it is cooperating closely with the FBI, sharing blockchain intelligence and investigative findings. The preliminary injunction prohibits the transfer or dissipation of specifically identified assets while litigation continues, and the company says it intends to seek additional judicial relief as the case progresses.
Co-founder and chief executive Ben Zhou framed the lawsuit as part of a broader accountability effort. “The Lazarus attack wasn’t just an attack on Bybit,” he said. “It was an attack on trust in our industry. That’s why we’ve worked closely with investigators, exchanges, regulators, law enforcement, and now the courts.”
To date, the exchange says approximately $48.4 million in stolen assets has been recovered, and a further $30.5 million has been frozen across more than 28 exchanges and custodians pending further legal and investigative action. Those figures represent a fraction of the $1.5 billion allegedly taken, but Bybit’s recovery programme has also supported broader enforcement actions: German authorities dismantled the cryptocurrency exchange eXch, and German and Swiss authorities subsequently disrupted the Cryptomixer.io service, removing two channels allegedly used to launder illicit proceeds.
Market and regulatory context
The Bybit case crystallises a broader shift in how the digital assets industry is beginning to respond to state-sponsored cybercrime. Rather than treating large-scale theft as an insurance or reputational matter alone, exchanges are increasingly reaching for civil litigation as a supplementary tool alongside criminal referrals and on-chain tracing. This approach depends on the quality of blockchain analytics and on cross-border judicial cooperation, both of which are still maturing.
From a regulatory standpoint, the case carries read-across implications across several jurisdictions. In the EU, the Markets in Crypto-Assets regulation places security obligations on crypto-asset service providers, and a loss event of this scale would attract supervisory attention from national competent authorities. In the UK, the FCA has tightened its expectations around operational resilience for registered cryptoasset firms. In the UAE, where Bybit is headquartered, the Virtual Assets Regulatory Authority has been developing its own oversight framework, and high-profile incidents test whether that framework has adequate incident-response and asset-recovery teeth.
The lawsuit also sets a precedent for using civil courts to pursue sovereign or quasi-sovereign defendants. Suing a nation-state in a US district court is procedurally complex under the Foreign Sovereign Immunities Act, and enforcement of any eventual judgment against North Korean state assets would face substantial practical obstacles. The more actionable near-term lever is the injunction against the John Doe defendants who are actively moving funds, where court orders can be enforced against identifiable wallets and cooperating custodians.
For the broader industry, the case makes the cost of large-scale theft more visible and more contested. Whether that deters sophisticated state actors is uncertain, but it signals that exchanges with the resources to litigate will do so.
The post Bybit Sues North Korea and Lazarus Group Over $1.5bn Crypto Theft appeared first on The Fintech Times.
