Bybit sues North Korea and Lazarus Group as recovery nears $80 million

Bybit has taken the February 2025 theft of $1.5 billion in crypto to a US courtroom, filing a civil lawsuit against North Korea and the Lazarus Group. 

So far, it has won a preliminary injunction that freezes the stolen funds investigators can still reach. 

Why is Bybit filing this civil case?

The complaint was filed in the US District Court for the District of Columbia and names the Democratic People’s Republic of Korea, its Reconnaissance General Bureau, and the Lazarus Group, according to Bybit’s press statement. Also named are unidentified individuals and entities holding or moving the money, listed as John Doe defendants.

However, suing a sanctioned state like North Korea may not give the plaintiff the desired result, as there is no one to enforce whatever judgment they receive against them.

Bybit understands this and has found a way around it by adding anonymous wallet holders and intermediaries. This gives it a legal route to identify them and claw back whatever remains traceable. 

The exchange said the court found that “Bybit has demonstrated a likelihood of success on the merits,” and also referenced the theft when it granted a temporary restraining order as “one of the largest cryptocurrency thefts in history.”

Ben Zhou, Bybit’s co-founder and CEO, said it was an industry problem, stating, “The Lazarus attack wasn’t just an attack on Bybit. It was an attack on trust in our industry.” He added that the exchange has worked “with investigators, exchanges, regulators, law enforcement, and now the courts.”

How much has Bybit been able to recover?

According to Bybit, it has recovered around $48.4 million in stolen assets, and about $30.5 million more has been frozen across more than 28 exchanges and custodians pending further action. 

However, this is still a very small fraction of the $1.5 billion that was stolen, which Bybit also acknowledged.

In its June filing, the exchange mentioned that 90.2% of the stolen assets had already gone dark after moving through mixers, cross-chain bridges, and over-the-counter dealers. It stated that only 9.8% was traced to identifiable wallets, with about $75.5 million frozen or recovered at that point. 

Zhou had said a year earlier that close to 69% of the funds were still traceable. However, recent submissions show that the window has been closing fast.

The laundering trail and the courtroom timeline

The lawsuit is the visible end of a longer legal effort. According to the unsealed records, Bybit first filed under seal on June 18, obtained a temporary restraining order and expedited discovery on June 19, saw the order renewed on July 16, and won a partial preliminary injunction on July 30. 

The complaint seeks the return of the stolen funds, plus punitive and treble damages under the US Racketeer Influenced and Corrupt Organizations Act.

Some of the recovery has come through law enforcement pressure on the laundering infrastructure itself. Bybit credited German authorities with dismantling the exchange eXch and German and Swiss authorities with disrupting the service Cryptomixer.io, both used to move illicit proceeds. 

eXch had been accused of letting the hackers cash out, with more than $90 million funneled through it in the weeks after the breach.

The FBI publicly blamed North Korea for the Bybit theft on February 26, 2025, tagging the activity “TraderTraitor” and warning that the actors were converting the stolen Ether to Bitcoin across thousands of addresses. 

Bybit says its civil case runs alongside the criminal investigations and that it continues to share blockchain intelligence with agencies, including the FBI.