This advanced journalistic report covers the background and details of Bybit suing North Korea to recover stolen funds, along with related topics in the global technology and regulatory sector.
Article index:
- Civil lawsuit filed against North Korea and the Lazarus Group
- Preliminary injunction to freeze digital assets
- Statements from Bybit’s co-founder and CEO
- Recovery results and international cooperation
- Dismantling money laundering platforms and enhancing future security
- Frequently asked questions
Civil lawsuit filed against North Korea and the Lazarus Group
Bybit, the world’s second-largest cryptocurrency exchange by trading volume, announced an unprecedented legal step today by filing a civil lawsuit in the U.S. District Court for the District of Columbia against the Democratic People’s Republic of Korea (North Korea), the North Korean Reconnaissance General Bureau, and the Lazarus Group, which has been identified by U.S. authorities as a North Korean-linked hacking group responsible for the massive cyberattack in February 2025 targeting the exchange’s digital assets and users.
Preliminary injunction to freeze digital assets
Bybit has secured a preliminary injunction ordering the freeze of identified stolen assets held by unknown individuals and entities holding or transferring these funds, referred to in the lawsuit as John Doe defendants. The order aims to preserve the identified stolen digital assets and prevent their transfer throughout the duration of the lawsuit, marking a significant step in Bybit’s ongoing recovery efforts, support for international law enforcement investigations, and promotion of accountability for large-scale cybercrimes. In this context, the court concluded that Bybit demonstrated a strong likelihood of success on the merits based on conclusive documents.
Statements from Bybit’s co-founder and CEO
Ben Zhou, co-founder and CEO of Bybit, stated: “Our priorities have never changed: protecting our users first, recovering what we can, and ensuring those responsible for these attacks are held accountable. The Lazarus attack was not just targeted at Bybit; it was an attack on the reliability and credibility of our entire industry. Because of this, we have intensified our cooperation with investigators, exchanges, regulators, law enforcement agencies, and now the courts. We hope this step represents further progress toward making the cryptocurrency industry a more difficult environment for criminals and a safer place for everyone.”
Recovery results and international cooperation
Since the February 2025 incident, Bybit has collaborated with blockchain analytics firms, exchanges, custodians, and international law enforcement agencies to track stolen assets and disrupt money laundering networks. To date, direct efforts have achieved the following results: approximately $48.4 million in stolen assets have been recovered, and assets valued at over $30.5 million have been frozen across more than 28 exchanges and custodians pending further legal action and ongoing court proceedings.
Dismantling money laundering platforms and enhancing future security
The investigations and intelligence provided by Bybit have contributed to supporting wide-scale law enforcement actions targeting the infrastructure used to launder stolen funds. German authorities dismantled the Xchange cryptocurrency exchange, while German and Swiss authorities subsequently disrupted CryptoMixer, shutting down key channels used to transfer illicit proceeds. Bybit affirms its commitment to deploying all legal and technical efforts to provide a secure and reliable digital financial environment for all participants and to protect the global financial system.
Frequently asked questions
Question: Which entities did Bybit file a lawsuit against?
Answer: Bybit filed a civil lawsuit against North Korea, the Reconnaissance General Bureau, and the Lazarus Group, which is accused of stealing $1.5 billion.
Question: What is the total value of digital assets recovered and frozen so far?
Answer: Assets worth $48.4 million have been recovered, and an additional $30.5 million in assets have been frozen across 28 exchanges and custodians.
Question: What is the purpose of the preliminary injunction obtained by Bybit?
Answer: It aims to prevent the transfer or disposal of stolen digital assets throughout the duration of the lawsuit until legal recovery procedures are completed.
Question: How has Bybit’s cooperation with law enforcement affected suspicious platforms?
Answer: The cooperation led to the dismantling and closure of major money laundering platforms such as Xchange and CryptoMixer by German and Swiss authorities.
