Bybit has filed a civil lawsuit against North Korea, its Reconnaissance General Bureau, and the Lazarus Group over the $1.5 billion hack from February 2025. The exchange also secured a preliminary injunction freezing certain identified stolen assets.
This legal step forms part of broader efforts to recover funds from one of the largest cryptocurrency thefts in history.
The Drivers of This Lawsuit
U.S. authorities have attributed the February 21, 2025 attack, which removed more than 400,000 ETH and stETH valued at about $1.5 billion, to the North Korean-linked Lazarus Group. Bybit is pursuing the return of assets and damages in the U.S. District Court for the District of Columbia while the court order restricts movement of traceable funds held by unidentified parties.
For perspective, the breach accounted for the majority of the more than $2 billion stolen by North Korean actors in 2025 and belongs to a longer series of state-linked crypto thefts totaling billions.
It is important to note the fundamental difference: the civil lawsuit prioritizes asset recovery and civil accountability, while concurrent criminal investigations by U.S. law enforcement proceed separately.
Impact and Broader Context
Bybit reports recovering approximately $48.4 million so far and freezing more than $30.5 million across multiple platforms. The injunction is designed to preserve remaining identifiable assets during the litigation.
This case sparks important discussions about addressing state-sponsored cybercrime, the role of civil courts in crypto recovery, and cross-border cooperation. Supporters emphasize the importance of pursuing accountability and deterrence. Others note the practical limits of enforcing outcomes against nation-state entities.
Analysts observe that landmark suits of this kind probe the effectiveness of available legal tools and may prompt other victims to follow similar paths. Ongoing collaboration with investigators and analytics providers remains key.
As proceedings continue and additional recovery measures are pursued, the results will help shape industry strategies against major nation-state linked attacks. Persistent tracing and legal action will influence the extent of further restitution.
This analysis is based on court filings, company statements, and industry reports for accuracy and reliability. Case progress remains subject to ongoing legal developments.