Summary
- Bybit sued North Korea, its Reconnaissance General Bureau, and Lazarus Group over cryptocurrency stolen during the February 2025 exchange breach.
- Bybit has recovered $48.4 million, while another $30.5 million remains frozen across more than 28 cryptocurrency exchanges and custodians.
- Blockchain tracing, international enforcement cooperation, and court protections are supporting Bybit’s efforts to preserve assets linked to the massive hack.
Bybit has sued North Korea and the Lazarus Group in a U.S. federal court over cryptocurrency stolen from its exchange. The lawsuit also targets North Korea’s Reconnaissance General Bureau and unidentified parties allegedly holding or moving assets linked to the attack.
Moreover, Bybit secured a preliminary injunction restricting identified defendants from transferring or disposing of cryptocurrency connected to the case. The exchange filed the lawsuit in the U.S. District Court for the District of Columbia as part of its recovery campaign.
U.S. authorities have previously linked the February 2025 attack to North Korean actors associated with the Lazarus Group. Significantly, the court determined that Bybit demonstrated a likelihood of succeeding on the merits of its claims.
That finding gives Bybit another legal mechanism for preserving identified cryptocurrency while the court considers its broader recovery claims. Meanwhile, the civil lawsuit remains separate from criminal investigations conducted by U.S. authorities into the attack and related laundering activity. Bybit has also shared blockchain intelligence and investigative findings with law enforcement agencies, including the Federal Bureau of Investigation.
Also Read: US Sanctions Two Crypto Exchanges Over Alleged Iranian Financial Network Links
Bybit Recovers Millions as Legal Effort Targets Remaining Stolen Crypto
Bybit has recovered approximately $48.4 million worth of cryptocurrency stolen during the February 2025 security breach. Another $30.5 million remains frozen across more than 28 cryptocurrency exchanges and custodians involved in the broader recovery operation.
Consequently, approximately $78.9 million has either returned to Bybit or remains inaccessible to parties allegedly controlling the stolen assets. However, investigators still face significant challenges because most cryptocurrency connected to the attack remains outside recovered or frozen amounts.
Investigators have traced stolen assets through numerous blockchain addresses, exchanges, custodians, and services involved in moving the cryptocurrency. Additionally, Bybit has worked with blockchain analytics companies, international law enforcement agencies, cryptocurrency exchanges, and custodians throughout the investigation.
Those partnerships help investigators identify transaction routes when stolen cryptocurrency reaches platforms capable of restricting withdrawals or freezing assets. Authorities have also targeted infrastructure allegedly connected to cryptocurrency laundering networks involved in handling proceeds from illicit activities.
German authorities dismantled cryptocurrency exchange eXch, while German and Swiss authorities later disrupted cryptocurrency mixing service Cryptomixer.io.
Conclusion
Bybit’s lawsuit adds civil litigation to blockchain tracing, exchange cooperation, and law enforcement measures supporting its cryptocurrency recovery campaign. The injunction provides another mechanism for preserving identified assets while Bybit pursues the remaining cryptocurrency through legal and investigative channels.
Also Read: Dogecoin Contributor Issues Major Wallet Security Warning to DOGE Holders
