Bybit, the world’s second-largest cryptocurrency exchange by trading volume, has initiated a civil lawsuit in the U.S. District Court for the District of Columbia against the Democratic People’s Republic of Korea (DPRK), its Reconnaissance General Bureau (RGB), and the Lazarus Group. U.S. authorities have identified the Lazarus Group as the DPRK-linked hacking entity allegedly responsible for a $1.5 billion cyberattack that occurred in February 2025.
The lawsuit seeks to recover the stolen digital assets, with Bybit securing a preliminary injunction to freeze identified funds held by unidentified individuals and entities, designated as “John Doe defendants” in the case. This court order aims to preserve the identified stolen digital assets as the litigation proceeds. The court reportedly found that “Bybit has demonstrated a likelihood of success on the merits” in its claim.
Table of Contents
Bybit -Legal Action Aims to Enhance Accountability
The legal proceedings are part of a broader strategy by Bybit that combines blockchain intelligence, international cooperation, and judicial remedies to target the perpetrators of the cyberattack. While government authorities handle criminal investigations, Bybit states that civil proceedings offer an additional mechanism for asset preservation and protecting affected stakeholders.
Ben Zhou, Co-founder and CEO of Bybit, commented on the filing: “Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable.” Zhou added that the Lazarus Group incident represented “an attack on trust in our industry,” prompting Bybit’s collaboration with investigators, exchanges, regulators, and law enforcement.
The preliminary injunction specifically prohibits the transfer or dissipation of assets linked to the case while the litigation is ongoing. Bybit indicated its intention to pursue further judicial relief as the proceedings advance. The civil action is being pursued independently of ongoing criminal investigations by U.S. law enforcement, with Bybit asserting continued cooperation with agencies such as the FBI by sharing blockchain intelligence and investigative findings.
International Cooperation and Asset Recovery Efforts
Since the February 2025 incident, Bybit has engaged with blockchain analytics firms, other exchanges, custodians, and international law enforcement agencies to trace stolen assets and disrupt money laundering networks.
To date, approximately US$48.4 million in stolen assets has been recovered. Additionally, about US$30.5 million has been frozen across more than 28 exchanges and custodians, pending further legal and investigative actions. These efforts have reportedly supported broader enforcement actions, including the dismantling of the cryptocurrency exchange eXch and the disruption of Cryptomixer.io by German and Swiss authorities, which were key channels for moving illicit proceeds.
Bybit’s commitment extends to improving security standards across the cryptocurrency industry, including investments in advanced blockchain intelligence capabilities and enhanced cooperation with regulators. For more information on Bybit’s services and operations, visit their official website at www.bybit.com (https://www.bybit.com/).
TechnoSports continues to monitor these significant industry developments in digital assets (https://technosports.co.in/) and cybersecurity as the digital asset ecosystem evolves.
