Key Insights
- Bybit has filed a U.S. lawsuit against North Korea, its intelligence agency and the Lazarus Group over the $1.5 billion crypto hack carried out in February 2025.
- A federal court granted expedited discovery and approved orders freezing certain traceable assets linked to the stolen funds.
- Court filings show 90.2% of the stolen cryptocurrency has become untraceable, while approximately $75.5 million has been frozen or recovered.
DUBAI/WASHINGTON, (MarketsXplora) – Cryptocurrency exchange Bybit has filed a civil lawsuit in a U.S. federal court against North Korea, its military intelligence agency and the Lazarus Group hacking organization, seeking to recover assets linked to the record-breaking $1.5 billion theft that struck the exchange in February 2025.
Bybit takes recovery fight from blockchain to courtroom
The Dubai-based exchange said it secured a preliminary injunction from the U.S. District Court for the District of Columbia that freezes certain traceable assets allegedly tied to the hack while the case proceeds. The order applies to unidentified individuals and entities named as “John Doe” defendants who are believed to be holding portions of the stolen funds.
The lawsuit names the Democratic People’s Republic of Korea (DPRK), its Reconnaissance General Bureau (RGB) intelligence agency and the Lazarus Group, which U.S. authorities have previously linked to a series of major cryptocurrency thefts.
The February 2025 breach remains the largest cryptocurrency exchange hack on record. Attackers stole more than 400,000 ether and staked ether tokens worth approximately $1.5 billion at the time, according to investigators. The FBI later attributed the attack to North Korean actors associated with the Lazarus Group.
Court grants discovery powers to trace stolen funds
Court records unsealed this week show that Bybit filed the lawsuit under seal on June 18 and obtained expedited discovery authority a day later, allowing the company to seek information from third parties before the normal discovery process begins.
The discovery orders could help the exchange identify account holders, balances and transaction histories linked to assets that remain traceable. Bybit alleged in its complaint that some of the stolen cryptocurrency moved through exchanges operating in the United States or maintaining infrastructure there.
Bybit said the legal action is designed not only to obtain a judgment against North Korea but also to identify intermediaries and recover assets that remain within reach of courts and cooperating service providers.
90.2% of the stolen assets have become untraceable
The exchange faces an increasingly difficult recovery effort. According to court filings, 90.2% of the stolen assets had become untraceable by June after being routed through cryptocurrency mixers, cross-chain bridges and over-the-counter trading networks. Only 9.8% remained linked to identifiable wallets.
Bybit said approximately 5.3% of the stolen funds, or about $75.5 million, had been frozen or recovered as of the filing date. The figures represent a sharp decline in traceability from earlier stages of the investigation, highlighting the challenges of tracking stolen digital assets across multiple blockchain networks.
In addition to seeking the return of stolen cryptocurrency, the exchange is requesting roughly $1.5 billion in compensatory damages, punitive damages and treble damages under the U.S. Racketeer Influenced and Corrupt Organizations Act (RICO).
The lawsuit is being pursued separately from ongoing criminal investigations by U.S. law enforcement agencies, Bybit said.
North Korea has repeatedly denied involvement in cyber thefts and has not publicly commented on the lawsuit. Bybit’s case is likely to test how effectively U.S. courts can help cryptocurrency firms trace and recover digital assets allegedly stolen by state-sponsored hackers operating outside American jurisdiction.