Bybit has secured a U.S. court order freezing crypto assets linked to the roughly $1.5 billion hack in February 2025, as it pursues a civil lawsuit against North Korea, the Reconnaissance General Bureau, and the Lazarus Group. Filed in the U.S. District Court for the District of Columbia on August 7, 2026, the lawsuit marks a new legal escalation in asset-recovery efforts following the attack attributed by the FBI to hackers linked to North Korea.
Bybit Turns to U.S. Court for Asset Recovery
According to an August 7 announcement by Bybit, the civil lawsuit targets the Democratic People’s Republic of Korea, the Reconnaissance General Bureau, and the Lazarus Group. The Lazarus Group is a hacker group frequently associated by U.S. authorities with North Korea’s state-sponsored cyber operations. This represents a notable legal move as Bybit is utilizing U.S. courts to preserve traced assets, rather than relying solely on criminal investigations, on-chain alerts, or voluntary cooperation from crypto platforms.
The preliminary injunction order prohibits the transfer or dissipation of assets identified as linked to the incident. Bybit stated that the court found the exchange had demonstrated a “likelihood of success on the merits,” meaning it possesses a sufficiently strong legal basis at the initial stage of the lawsuit. The company also said it would continue to seek further judicial remedies as the legal proceedings progress.
According to Bybit, approximately $48.4 million in stolen assets has been recovered, while more than $30.5 million remains frozen across over 28 exchanges and custodians. While these figures still represent only a small fraction of the total losses, they show that recovery efforts have entered a phase with clearer legal leverage.
Why the Injunction Matters
In crypto, stolen assets can be split, swapped, and routed across multiple blockchains before the victim can request a freeze. Therefore, a preliminary injunction from a U.S. court provides Bybit with additional legal grounds to demand that exchanges, custodians, or holders of relevant assets preserve the traced funds.
Notably, the lawsuit targets entities alleged to have ties to the North Korean state, rather than a private hacker group. The FBI previously attributed the Bybit hack to North Korea’s TraderTraitor activity and warned that the stolen assets had been converted and dispersed across multiple blockchain addresses. This makes the recovery process heavily reliant on coordination between on-chain analytics, court orders, and compliant intermediaries.
The court order does not mean Bybit will recover all of the stolen funds. However, it helps the exchange exert further legal pressure at points where the funds touch controllable systems, particularly centralized exchanges and custodians. For assets that have passed through bridges, DEXs, mixers, or non-compliant platforms, recovery remains an open question.
The Hack Behind the Case
The lawsuit stems from the February 2025 Bybit hack, one of the largest crypto thefts ever recorded. According to Bybit’s incident timeline, the attack occurred on February 21, 2025, and affected a single Ethereum cold wallet of the exchange. Bybit stated that losses reached approximately $1.46 billion, including 401,347 ETH, 90,375 stETH, 15,000 cmETH, and 8,000 mETH.
Bybit stated that the attacker exploited the transaction signing process of its Safe multisig cold wallet, causing a malicious transaction to be approved and allowing assets to leave the ETH cold wallet. Following the incident, CEO Ben Zhou stated that Bybit remained solvent and customer assets were backed 1:1, even if the hacked funds were not recovered.
North Korea Responsible for $1.5 Billion Bybit Hack. Source: PSA
On February 26, 2025, the FBI issued a public warning identifying North Korea as responsible for the theft of approximately $1.5 billion in virtual assets from Bybit. The agency stated that hackers operating under TraderTraitor swiftly converted and dispersed the assets, while urging exchanges, bridges, DeFi services, and blockchain analytics firms to block transactions linked to the flagged addresses.
What Comes Next
Despite obtaining the court order, Bybit still faces a long road to convert frozen funds into actual recovered assets. The company states that $48.4 million has been recovered and over $30.5 million is frozen, but this total remains very small compared to the initial loss of nearly $1.5 billion. The remainder may have been converted, dispersed, or routed through platforms that make enforcement of the court order more difficult.
Bybit stated that the civil lawsuit proceeds independently of criminal investigations by U.S. law enforcement, though the company continues to coordinate with the FBI and investigative partners by sharing blockchain data. Key points to watch moving forward include whether the court releases further detailed filings, how many additional assets are frozen, and through what process the frozen assets may be returned to Bybit.
