Bybit has taken its recovery effort from the February 2025 security breach into U.S. federal court, suing North Korea, its Reconnaissance General Bureau and the Lazarus Group. The case, Bybit Technology Limited v. Democratic People’s Republic of Korea, was filed in the U.S. District Court for the District of Columbia on June 18, 2026. The lawsuit adds a civil recovery track to the criminal and blockchain investigations surrounding the $1.5 billion theft.
The exchange publicly disclosed the action on August 7 after previously pursuing the matter under seal. Bybit also obtained a preliminary injunction covering identified stolen assets held or moved by unidentified individuals and entities named as John Doe defendants. The order restricts the transfer or dissipation of those traced assets while the litigation remains active, but it does not represent a final judgment on liability.
Court Order Targets Assets Linked to the Hack
The injunction gives Bybit a judicial mechanism for preserving assets that investigators have connected to the breach while the company continues pursuing recovery. Bybit said the court found that it had demonstrated a likelihood of success on the merits when granting preliminary relief. That finding supports an interim asset freeze rather than resolving the underlying claims against North Korea or the other defendants.
The lawsuit stems from the February 21, 2025 compromise of a Bybit Ethereum cold wallet. Bybit’s incident records put the loss at approximately $1.46 billion, including 401,347 ETH alongside stETH, cmETH and mETH. The attack compromised a single cold wallet but produced losses on a scale unprecedented for the exchange.
U.S. authorities subsequently attributed the theft to North Korean actors. The FBI said on February 26, 2025 that the Democratic People’s Republic of Korea was responsible for the approximately $1.5 billion theft and identified the activity as TraderTraitor. The federal attribution gives Bybit’s allegations against North Korean actors an independent law-enforcement foundation, although the claims in the civil case still remain subject to judicial proceedings.
Recovery Effort Extends Beyond the Lawsuit
Bybit says approximately $48.4 million in stolen assets has been recovered, while more than $30.5 million has been frozen across more than 28 exchanges and custodians pending further legal or investigative action. Those figures show that the lawsuit forms only one component of a broader recovery campaign involving blockchain tracing, custodians and law-enforcement cooperation.
The technical investigation into the original breach also identified an external compromise rather than a vulnerability in Safe smart contracts. Safe Ecosystem Foundation said a compromised Safe{Wallet} developer machine allowed the attackers to propose a disguised malicious transaction targeting Bybit. That distinction places the incident in the realm of infrastructure and transaction-signing security rather than a failure in the underlying Ethereum or Safe smart contract code.
The litigation now shifts attention from attribution toward preservation and potential recovery of traceable assets. Criminal investigations remain separate, and Bybit has said it intends to seek additional judicial relief as the case progresses. The preliminary injunction gives the exchange a legal tool to restrict movement of identified funds, but the ultimate amount recoverable through the case remains unresolved.