Bybit Takes Legal Action Against North Korea
In a groundbreaking legal move, crypto exchange Bybit has taken North Korea, along with its intelligence agency and the notorious Lazarus Group, to a federal court in the United States. This legal action aims to reclaim funds that were siphoned off during a massive cyber heist totaling approximately $1.5 billion in cryptocurrencies. The civil lawsuit was filed in the U.S. District Court for the District of Columbia, targeting the Democratic People’s Republic of Korea (DPRK), its Reconnaissance General Bureau, and the criminal Lazarus Group.
The Cyber Heist and Legal Proceedings
The case revolves around a significant breach that occurred on February 21, 2025, resulting in the theft of over 400,000 Ether (ETH) and staked Ether from Bybit’s operations. Details revealed soon after the incident indicated that U.S. authorities, including the FBI, had quickly linked the breach to North Korean actors, who are often referred to under the alias TraderTraitor. Following the attack, U.S. officials warned cryptocurrency exchanges, validators, and blockchain companies to be vigilant against any transactions connected to the laundering efforts attributed to these actors.
“Our focus has never shifted: we aim first to safeguard our users, recover lost assets, and ensure accountability for those initiating these attacks,” stated Ben Zhou, the co-founder and CEO of Bybit.
Detailing their pursuit of justice, Bybit secured a preliminary injunction that specifically pertains to certain stolen assets currently in the hands of unnamed individuals and entities identified as John Doe defendants. This legal order prohibits those defendants from selling, transferring, or disposing of the identified stolen assets throughout the duration of the litigation process. However, it is important to note that this injunction does not constitute a determination of guilt or ownership at this stage.
Challenges in Asset Recovery
As the lawsuit unfolds, Bybit plans to seek additional remedies, parallel to the ongoing criminal investigations by U.S. law enforcement into North Korea’s cyber activities. This action marks a significant step for Bybit, providing the exchange access to a U.S. civil route for asset recovery, particularly after months of relying on blockchain tracing, voluntary asset freezes, and bounty programs for information leading to asset recoveries.
Despite reports indicating that a substantial portion—88.87%—of the stolen funds remained traceable as of March 2025, challenges arose when the hackers obscured the trail by converting their stolen Ether into Bitcoin and distributing it across numerous wallets. By April 2025, it was reported that 27.6% of the stolen assets were untraceable.
The Lazarus Group employed strategies such as cross-chain protocols and crypto mixers to complicate further investigations into their activities. In past months, Bybit attempted to engage with industry partners and forensic investigators to identify or freeze these funds, offering rewards for their assistance. Moreover, the exchange took proactive measures to cover losses incurred from the attack, sourcing additional Ether and leveraging loans and deposits to ensure that customer withdrawals remained operational.
The Broader Context of North Korean Cyber Theft
Data from Chainalysis reveals that North Korean groups were responsible for an estimated $2.02 billion in cryptocurrency theft throughout 2025. The Bybit incident represents a significant portion of these losses, bringing the nation’s total crypto theft estimates to around $6.75 billion. The threat posed by Lazarus Group persisted into 2026, with further reports of breaches resulting in losses of $577 million from entities such as Drift Protocol and KelpDAO.
As Bybit prepares to engage further in this legal battle, its immediate focus will be on pushing for permanent relief and recovering the assets protected under the current injunction. The court has yet to issue a final verdict concerning the civil case, presenting an ongoing and complex legal challenge for the exchange.
