Cryptocurrency exchange Bybit has filed a civil lawsuit against North Korea, its Reconnaissance General Bureau, and the Lazarus Group over a February 2025 cyberattack described by a U.S. court as “one of the largest cryptocurrency thefts in history.”
The lawsuit was filed in the U.S. District Court for the District of Columbia and targets the Democratic People’s Republic of Korea (DPRK), its intelligence agency, and the hacking group that U.S. authorities have linked to the attack.
Bybit said it has also secured a preliminary injunction freezing identified stolen assets held or moved by unidentified individuals and entities named as John Doe defendants in the case.
The injunction prohibits the transfer or dissipation of assets connected to the attack while litigation continues.
In granting the order, the court found that Bybit had “demonstrated a likelihood of success on the merits” of its claims.
“Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable,” Bybit co-founder and CEO Ben Zhou said.
“The Lazarus attack wasn’t just an attack on Bybit. It was an attack on trust in our industry,” Zhou added.
The civil case is separate from criminal investigations being conducted by U.S. authorities. Bybit said it continues to cooperate with agencies including the Federal Bureau of Investigation, sharing blockchain intelligence and investigative findings.
Since the February 2025 attack, about $48.4 million in stolen assets has been recovered, according to Bybit.
More than $30.5 million has also been frozen across over 28 cryptocurrency exchanges and custodians pending further legal and investigative action.
Bybit has worked with blockchain analytics companies, exchanges, custodians, and law enforcement agencies to trace the stolen assets and disrupt networks allegedly used to launder the proceeds.
The company cited enforcement actions in Europe as part of the wider effort, including German authorities’ dismantling of cryptocurrency exchange eXch and subsequent action by German and Swiss authorities against Cryptomixer.io.
Bybit said it plans to seek additional judicial relief as the U.S. proceedings advance while continuing to cooperate with law enforcement agencies investigating the attack.
“The real test comes after the crisis,” Zhou said. “Trust isn’t something you claim. You have to earn it through action, every single day.”
