Bybit, the cryptocurrency exchange targeted in a major cyberattack in February 2025, has filed a civil lawsuit in the US District Court for the District of Columbia against the Democratic People’s Republic of Korea (DPRK), its Reconnaissance General Bureau (RGB) and the Lazarus Group.
US authorities have identified Lazarus as a DPRK-linked hacking group. Bybit alleges that the defendants were responsible for the February 2025 attack, which resulted in the theft of cryptocurrency assets. The exchange has also obtained a preliminary injunction covering identified stolen assets held or transferred by unidentified individuals and entities named as John Doe defendants in the case. The order is intended to prevent the assets from being transferred or otherwise dissipated while the civil proceedings continue.
In granting the relief, the court found that “Bybit has demonstrated a likelihood of success on the merits” in its lawsuit. The legal action provides a civil route for attempting to preserve and recover assets while criminal investigations into the attack continue. Bybit said it is using blockchain analysis, cooperation with other companies and law enforcement engagement alongside the court proceedings to track the stolen funds.
“Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable,” said Ben Zhou, Co-founder and CEO of Bybit. “The Lazarus attack wasn’t just an attack on Bybit. It was an attack on trust in our industry. That’s why we’ve worked closely with investigators, exchanges, regulators, law enforcement, and now the courts. We hope this marks another step toward making crypto a much harder place for criminals to operate in and a much safer place for everyone else.”
The preliminary injunction prohibits the transfer or dissipation of identified assets connected to the case while the litigation proceeds. Bybit said it plans to seek additional judicial remedies as the case develops. The civil lawsuit is separate from criminal investigations being conducted by US authorities. Bybit said it continues to cooperate with agencies including the FBI, providing blockchain intelligence and investigative information that could assist wider investigations into the attack and subsequent movement of the stolen funds.
The case highlights the growing use of civil litigation alongside criminal enforcement in attempts to recover cryptocurrency stolen through large-scale cyberattacks. Because transactions on public blockchains can be traced, investigators and private-sector organisations can track funds as they move between wallets, exchanges and other services.
Since the February 2025 attack, Bybit has worked with blockchain analytics companies, cryptocurrency exchanges, custodians and law enforcement agencies to trace the stolen assets and identify potential laundering routes. The exchange said approximately US$48.4 million in stolen assets has been recovered to date. A further US$30.5 million has been frozen across more than 28 exchanges and custodians, pending additional legal and investigative action.
The investigation has also been linked to enforcement actions against cryptocurrency platforms allegedly used to move illicit funds. German authorities dismantled the cryptocurrency exchange eXch, while German and Swiss authorities later took action against Cryptomixer.io. Such actions demonstrate how cooperation between cryptocurrency companies, blockchain analytics providers and law enforcement agencies can be used to identify and disrupt infrastructure involved in moving stolen digital assets.
“The real test comes after the crisis,” Ben added. “That’s when you show whether your commitment is real. For us, that means continuing to strengthen our security, working hand in hand with investigators and industry partners, and doing everything we can to protect our users. Trust isn’t something you claim. You have to earn it through action, every single day.”
The Bybit case illustrates the increasingly complex response to cryptocurrency theft, where asset recovery can involve blockchain tracing, exchange-level freezes, international investigations and court orders spanning multiple jurisdictions. The exchange said it is continuing to invest in blockchain intelligence and security capabilities while working with other industry participants and regulators to improve the ability to trace and recover stolen digital assets.
The civil proceedings remain ongoing. Bybit said it will continue cooperating with relevant authorities and provide further information as permitted by the court.
