Bybit has officially filed a civil lawsuit against the Democratic People’s Republic of Korea, the Reconnaissance General Bureau, and the Lazarus Group hacking collective in the US District Court for the District of Columbia. The legal action follows a February 21, 2025 hack that drained over 400,000 ETH and staked ETH, worth approximately $1.5 billion, from the crypto exchange platform. This loss still holds the record as the largest crypto theft in the industry.
The lawsuit immediately yielded results in court. Bybit secured a preliminary injunction from a judge prohibiting unknown parties, or John Doe defendants, from moving, selling, or transferring the identified crypto assets while the litigation is ongoing.
The US Federal Bureau of Investigation (FBI) had previously confirmed that the attack was masterminded by the North Korean hacking group. The US government monitors the perpetrators’ activities under the codename TraderTraitor. Responding to this legal move, Bybit CEO Ben Zhou emphasized that the company’s priorities remain unchanged. “Our focus has always been to protect our users first, recover what we can, and ensure that the people behind this attack are held accountable,” Zhou said.
A Race Against Time and Mixers
The court-ordered asset freeze is crucial given the narrow window for on-chain tracking. In March 2025, approximately 88.87% of the stolen assets could still be traced, while 7.59% went untraceable and 3.54% were frozen. A month later, in April, Zhou revealed that the portion of funds that could no longer be traced had risen to 27.6%.
The Lazarus Group routinely utilizes cross-chain protocols and mixer services to obscure the transaction trail. This crypto laundering practice is designed to make assets difficult to track by law enforcement and blockchain forensics specialists.
A Trillion-Dollar Track Record
The attack on Bybit’s infrastructure accounted for the majority of the estimated $2.02 billion in crypto stolen by North Korean hackers throughout 2025, according to Chainalysis calculations. To date, the total crypto assets they have seized amount to approximately $6.75 billion.
State-sponsored hacking activities have not stopped. In April 2026, a series of attacks linked once again to the Lazarus Group reportedly drained $577 million from decentralized protocols Drift Protocol and KelpDAO.
Who Bore the Initial Losses
Despite losing $1.5 billion in assets, Bybit’s operations were not paralyzed. The company continued to process customer withdrawal requests as usual following the hack. They were able to cover the liquidity deficit by purchasing ETH on the open market, securing loans, and obtaining additional deposits from other industry partners.
This civil lawsuit paints a complete picture for the crypto industry. When security systems are breached by state-level actors, hunting down hackers and stolen funds is not an overnight task - exchanges are forced to independently find bailout funds to secure customer assets while the wheels of federal justice slowly turn.
As reported by crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
