Bybit has filed a civil complaint in the U.S. District Court for the District of Columbia against the Democratic People’s Republic of Korea, its Reconnaissance General Bureau and the Lazarus Group. The case covers the $1.5B theft of February 21, 2025, when more than 400,000 ETH and stETH left the exchange. A federal judge granted a preliminary injunction freezing the stolen assets identified so far. Roughly $48.4 million has been recovered and another $30.5 million sits frozen across the industry.
Key Takeaways
- Bybit is suing a sovereign state in a U.S. federal court over a $1.5B theft
- A preliminary injunction freezes the identified assets for the duration of the case
- $48.4 million has been recovered and $30.5 million frozen across 28+ exchanges and custodians
A Sovereign State Named in a Federal Complaint
The world’s second-largest exchange by trading volume has done something no venue had attempted at this scale. The complaint names the Democratic People’s Republic of Korea directly, alongside its Reconnaissance General Bureau, the Lazarus Group and a set of unidentified John Doe defendants.
Picking the civil track matters as much as picking the defendants. Criminal action against a foreign state apparatus stays symbolic while nobody can be arrested. A civil case moves money instead. It is the same lever an exchange pulls against a competitor, as in the filing where Binance is claiming $473M from RedotPay over 470,000 diverted users.
The court found that Bybit had demonstrated a likelihood of success on the merits. That phrasing is not decorative. It is the condition for granting the preliminary injunction, and it signals that the onchain tracing package the exchange put together held up in front of a federal judge.
The injunction bars any transfer or dissipation of the identified assets while the litigation runs. It targets the funds, not the people, which is what makes it usable against addresses whose holders remain unknown. Ben Zhou, co-founder and chief executive, framed the company line as protecting users first, recovering what can be recovered, and holding the attackers accountable.
$48.4 Million Back Out of $1.5 Billion
The recovery numbers size the problem honestly. Bybit reports roughly $48.4 million in stolen assets recovered and more than $30.5 million frozen across 28 or more exchanges and custodians. Measured against the original haul, the return rate is thin.
Laundering speed explains most of it. Funds run through mixers and cooperative venues before analysts have finished mapping the first hop. The same dynamic shows up at every size, including when three DeFi protocols were drained of $35M in six hours with no freeze available at all. German authorities dismantled the eXch exchange, and a joint German and Swiss operation disrupted Cryptomixer.io, two channels used to recycle illicit proceeds.
February 2025 is only one line in a longer ledger. North Korea moved $2.02 billion in stolen crypto across all of 2025, and the historical total attributed to its operators reaches $6.75 billion. Bybit is the heaviest single entry in a tally that spans years.
The gap between $1.5B stolen and $48.4 million clawed back restates a rule the industry keeps relearning. Money that leaves a centralized venue only becomes seizable again when it passes back through a control point, and those control points thin out with every hop.
Cooperation with the FBI continues in parallel with the civil case. The two tracks do not substitute for each other: one assigns responsibility, the other immobilizes balances. The procedural detail and the exact scope of the freeze are set out in the official statement Bybit released alongside the filing.
Also on Cryptonomic:
- MetaMask Opens Its Wallet to Autonomous AI Agents
- Ondo Founder’s Mother Sues to Take Back Control
- Japan FSA Wants Exchanges to Delay Crypto Withdrawals
Asset Freezes Are Becoming an Industry Weapon
In the near term, the injunction creates a de facto obligation for any venue sitting on part of the money. An address written into a federal order turns radioactive for a regulated custodian, which will freeze rather than argue.
That mechanic rewrites the economics of the attack. Stealing stays technically feasible. Cashing out gets slow and expensive. The weak point moves to the exit, where the attacker needs an intermediary willing to convert.
Over the next few quarters, the ruling is likely to serve as a template for the next exchange that gets hit. A venue losing nine figures now has documented precedent for obtaining a fast freeze, which shortens the window during which stolen funds circulate freely.
Regulators are pushing the same direction with different tools. Japan has just asked its platforms to hold withdrawals for a set period, and the FSA is betting on friction rather than binding rules to slow fraudulent funds on their way out.
The obvious limit still applies. A U.S. injunction binds only the actors who accept U.S. jurisdiction, and most North Korean liquidity moves through circuits that never do. The case improves the recovery rate at the margin without touching the cause.
Follow the story on Cryptonomic.
