Bybit has filed a civil lawsuit in the United States District Court for the District of Columbia against the Democratic People’s Republic of Korea, its Reconnaissance General Bureau intelligence agency, the Lazarus Group and a group of unidentified defendants. The action targets the February 21, 2025 theft of approximately $1.5 billion in Ethereum and staked Ethereum from the Dubai-based exchange, an incident investigators have described as the largest cryptocurrency heist on record.

Court records unsealed in early August 2026 show the complaint was submitted under seal on June 18. The following day a federal judge granted Bybit’s request for expedited discovery, allowing the company to seek account-holder identities, balances and transaction histories from platforms that operate or maintain infrastructure in the United States. The same day the court issued a temporary restraining order blocking the transfer of certain still-traceable assets. That order was later renewed and, on July 30, the court partially granted a preliminary injunction that freezes identified assets held by the John Doe defendants while the case proceeds.

Scale of the Breach and Attribution

Attackers drained more than 400,000 ETH and stETH from Bybit’s reserves. Forensic analysis indicated the breach began with compromised credentials belonging to a Safe Wallet developer, which enabled the injection of malicious code into cloud infrastructure. The Federal Bureau of Investigation publicly attributed the theft to North Korean actors on February 26, 2025, referring to the activity under the TraderTraitor designation commonly linked to the Lazarus Group.

By the time the lawsuit was filed, Bybit reported that 90.2 percent of the stolen assets had become untraceable after moving through mixers, cross-chain bridges and over-the-counter dealers. The remaining 9.8 percent stayed linked to identifiable wallets, of which roughly 5.3 percent—about $75.5 million—had already been frozen or recovered. The share of still-traceable funds had declined steadily from earlier estimates released in the months after the attack.

Legal Objectives and Court Measures

In the complaint Bybit seeks the return of the stolen assets, compensatory damages of approximately $1.5 billion, punitive damages and treble damages under the Racketeer Influenced and Corrupt Organizations Act. The preliminary injunction prohibits the unidentified defendants from transferring, selling or otherwise disposing of the listed assets for the duration of the litigation. Bybit has stated it intends to seek additional relief as the case advances.

The civil proceeding runs independently of ongoing criminal investigations by U.S. law-enforcement agencies. Bybit has said certain platforms indicated they would cooperate once presented with a formal court order, giving the discovery process a practical route to identify intermediaries and pursue the residual traceable portion of the funds.

Broader Context of North Korean Crypto Activity

Blockchain-analytics data indicate that North Korean-linked actors stole an estimated $2.02 billion in cryptocurrency during 2025, with the Bybit incident accounting for the majority of that total. Cumulative thefts attributed to the same actors have reached approximately $6.75 billion. Analysts and governments have long assessed that proceeds from such operations help finance the country’s weapons programs and circumvent international sanctions.

After the breach Bybit used Ether purchases, loans and deposits from industry counterparties to cover the shortfall, enabling the exchange to continue processing customer withdrawals. The company has also operated a bounty program and coordinated with other platforms and investigators in efforts to locate and freeze remaining assets.

The next stages of the litigation will focus on obtaining permanent relief and attempting to recover the assets covered by the injunction. No final judgment on liability or ownership has been issued.