Cryptocurrency exchange Bybit has filed a civil lawsuit in the U.S. District Court for the District of Columbia against North Korea, its Reconnaissance General Bureau (RGB), and the Lazarus Group over the February 2025 cyberattack that resulted in approximately $1.5 billion in stolen digital assets.
The exchange said the defendants include the DPRK and its intelligence agency, while the Lazarus Group has been identified by U.S. authorities as a North Korea-linked hacking organization.
Court Freezes Assets Linked to the Alleged Theft
Alongside the lawsuit, Bybit obtained a preliminary injunction preventing unidentified individuals and entities named as John Doe defendants from transferring or otherwise dissipating identified assets connected to the alleged theft.
The court’s intervention is intended to preserve potentially recoverable cryptocurrency while the civil proceedings continue. Bybit said the court found that the company had demonstrated a likelihood of success on the merits of its claims.
The ruling follows an earlier temporary restraining order in which the court described the incident as one of the largest cryptocurrency thefts in history.
Civil Case Adds a New Front to the Investigation
Bybit said the lawsuit is separate from criminal investigations being conducted by government authorities. The exchange continues to cooperate with U.S. law enforcement agencies, including the FBI, by providing blockchain intelligence and investigative information.
The company said the civil proceedings offer an additional mechanism for preserving stolen assets while criminal investigations pursue those allegedly responsible for the cyberattack.
Blockchain Tracking Drives Recovery Efforts
Since the February 2025 attack, Bybit said it has worked with blockchain analytics companies, cryptocurrency exchanges, custodians and international law enforcement agencies to trace the stolen funds.
According to the exchange, approximately $48.4 million worth of stolen assets has been recovered so far. A further $30.5 million has been frozen across more than 28 exchanges and custodians while legal and investigative processes continue.
The company said these efforts have also helped authorities identify and disrupt infrastructure allegedly used to launder proceeds from the attack.
European Authorities Disrupt Alleged Laundering Networks
Bybit pointed to several international enforcement actions as examples of cooperation between the cryptocurrency industry and government authorities.
German authorities dismantled the cryptocurrency exchange eXch, while German and Swiss authorities subsequently took action against Cryptomixer.io. Bybit said both operations were associated with channels allegedly used to move illicit cryptocurrency proceeds.
The exchange argued that such cases demonstrate how blockchain tracing and cooperation between private companies and law enforcement can help disrupt cross-border money-laundering operations.
Bybit CEO Says Attack Threatened Industry Trust
Bybit co-founder and CEO Ben Zhou said the company regards the incident as an attack not only against the exchange but also against confidence in the wider cryptocurrency sector.
He said Bybit’s response has focused on protecting users, recovering stolen assets and pursuing those responsible through cooperation with investigators, regulators, exchanges and law enforcement agencies.
Zhou also emphasized that the company intends to continue strengthening its security systems and pursuing avenues capable of making cryptocurrency networks more difficult for criminals to exploit.
Exchange Expands Security and Intelligence Operations
Bybit said the lawsuit forms part of a broader effort to improve security throughout the digital asset ecosystem.
The company plans to continue investing in blockchain intelligence, strengthening relationships with exchanges and regulators, and supporting initiatives designed to make cryptocurrency theft more difficult to execute and easier to trace.
Legal Action Targets Alleged State-Sponsored Cybercrime
The lawsuit represents an unusual escalation in the cryptocurrency industry’s response to large-scale cyberattacks, moving beyond asset tracing and criminal investigations into direct civil litigation.
Bybit said it intends to pursue additional judicial remedies as the case progresses and will continue working with law enforcement and industry partners to recover assets linked to the February 2025 attack.
The company said its objective is to use available legal and investigative mechanisms to hold the alleged perpetrators accountable and protect the broader digital asset ecosystem from increasingly sophisticated cybercrime.
