The crypto exchange says it has recovered $48.4 million and secured a court order freezing another $30.5 million.
Dubai: Cryptocurrency exchange Bybit has filed a civil lawsuit against North Korea, its Reconnaissance General Bureau and the Lazarus Group over the $1.5 billion cyberattack that targeted the exchange in February 2025. The company has also obtained a preliminary injunction to prevent identified stolen assets from being transferred while the case proceeds.
The lawsuit was filed in the US District Court for the District of Columbia. Bybit said the defendants include the Democratic People’s Republic of Korea, its intelligence agency and Lazarus Group, which US authorities have linked to numerous cyberattacks targeting cryptocurrency businesses.
The case also names unidentified individuals and entities as John Doe defendants because the company says some parties involved in moving or holding the stolen funds have not yet been identified.
According to Bybit, the court found that the exchange had demonstrated a likelihood of success on the merits when granting the preliminary injunction. The order is intended to preserve assets connected to the case while Bybit pursues further legal and investigative action.
$48.4 Million Recovered
The lawsuit forms part of Bybit’s broader effort to recover funds stolen in the February 2025 attack.
The exchange said it has recovered approximately $48.4 million in stolen assets so far. Another $30.5 million has been frozen across more than 28 cryptocurrency exchanges and custodians, pending further investigation and legal proceedings.
Bybit has worked with blockchain analytics companies, cryptocurrency exchanges, custodians and law enforcement agencies to track the stolen funds as they moved across different blockchain networks.
The exchange has also encouraged the wider crypto industry to help identify and block transactions linked to the attack.
How the Bybit Hack Happened
The February 21, 2025 attack involved approximately 401,000 Ethereum tokens, valued at about $1.5 billion at the time of the theft.
According to Bybit, attackers compromised one of its service providers and manipulated the digital wallet address involved in a transaction. The alteration caused the cryptocurrency to be transferred to a wallet controlled by the attackers rather than the intended destination.
The incident became one of the largest cryptocurrency thefts ever recorded and highlighted the risks surrounding third-party infrastructure used by digital-asset companies.
Bybit subsequently replenished the stolen assets through loans from investors and began tracing the funds through public blockchain networks.
The exchange also launched its Lazarus Bounty programme, offering incentives to help identify the movement of stolen assets and assist exchanges and other cryptocurrency services in freezing funds connected to the attack.
Legal Action Adds Another Recovery Route
The civil lawsuit is separate from criminal investigations being conducted by US authorities.
Bybit said it continues to cooperate with agencies including the FBI and is providing blockchain intelligence and investigative information that could assist law enforcement.
Civil proceedings can provide an additional mechanism for preserving assets identified during the tracing process. The preliminary injunction, for example, allows Bybit to seek to prevent certain assets from being moved while the case remains before the court.
The exchange has also pointed to actions taken against services allegedly used to move illicit cryptocurrency. It said German authorities dismantled the cryptocurrency exchange eXch, while German and Swiss authorities later disrupted Cryptomixer.io, which Bybit said had been linked to channels used to transfer illicit proceeds.
A Wider Fight Against Crypto Crime
Bybit’s lawsuit reflects a broader shift in how cryptocurrency companies respond to major cyberattacks. Blockchain transactions are publicly recorded, allowing investigators to follow the movement of stolen assets even when attackers attempt to obscure their origins through multiple wallets, exchanges and mixing services.
For Bybit, the legal case is therefore part of a larger recovery effort involving blockchain analysis, cooperation with exchanges, regulatory engagement and law enforcement investigations.
The exchange said it intends to pursue additional judicial measures while continuing to work with investigators and other industry participants.
The case remains ongoing, and the court’s preliminary injunction does not represent a final judgment on the claims. Bybit said it will continue pursuing the recovery of stolen assets and provide further information where permitted by the court.
Read more news and follow us on Instagarm
Photo: Virendra Saklani/Gulf News
