US Court Backs Bybit's Bid to Trace Funds from North Korea's $1.5 Billion Crypto Hack

Cryptocurrency exchange Bybit has filed a civil lawsuit in a U.S. federal court against North Korea, its Reconnaissance General Bureau (RGB), and the Lazarus Group, following a massive cyberattack on February 21, 2025, which resulted in the theft of approximately $1.5 billion in crypto assets. This legal maneuver marks a significant step in Bybit's ongoing efforts to recover the stolen funds and hold those responsible accountable. The U.S. court has granted Bybit's request for expedited discovery, allowing the exchange to seek account identities, balances, and transaction histories from platforms with U.S. operations that handled the stolen cryptocurrency.

The cyberattack in question occurred on February 21, 2025, leading to the illicit transfer of over 400,000 Ethereum (ETH) and staked Ethereum (stETH) tokens from Bybit's reserves. The Federal Bureau of Investigation (FBI) attributed this incident to the North Korea-linked Lazarus Group, identifying it as the largest cryptocurrency heist on record at the time. The attackers exploited a vulnerability in the user interface source code of Safe Wallet, a multi-signature software platform utilized by Bybit. During a routine transfer between cold and hot wallets, malicious JavaScript code was injected, tricking Bybit's authorized signers into approving a fraudulent transaction.

In conjunction with the lawsuit filed in the U.S. District Court for the District of Columbia, Bybit also secured a preliminary injunction to freeze certain stolen assets held by unidentified 'John Doe' defendants. This order aims to prevent the transfer or disposal of identified digital assets while the litigation proceeds. The expedited discovery ruling provides Bybit with a crucial legal avenue to trace the stolen funds, which are known to have been laundered through various methods, including mixers, cross-chain bridges, and numerous intermediary wallets.

This large-scale cyberattack severely impacted confidence within the crypto industry and heightened security concerns across the sector. Since the incident, Bybit has actively collaborated with blockchain analytics firms, other exchanges, custodians, and international law enforcement agencies to track the stolen assets and disrupt laundering networks. These concerted efforts have led to the recovery of approximately $48.4 million in stolen assets and the freezing of over $30.5 million across more than 28 exchanges and custodians. Ben Zhou, co-founder and CEO of Bybit, emphasized the company's unwavering focus on protecting users, recovering assets, and ensuring accountability for those behind the attack.

The incident is set against the broader geopolitical backdrop of North Korea increasingly relying on cyber heists to fund its nuclear and ballistic missile programs. According to Chainalysis data, North Korean hackers stole an estimated $2.02 billion in cryptocurrency during 2025, with the Bybit attack accounting for a significant portion of this sum. The cumulative total of North Korean crypto thefts is estimated to be around $6.75 billion, highlighting the severe threat posed by state-sponsored cybercrime to global financial stability and cybersecurity.

While Bybit's civil lawsuit operates independently of ongoing criminal investigations, it provides an additional mechanism for asset recovery and holding cybercriminals accountable. Analysts and market observers suggest that such legal initiatives could enhance deterrence against cyberattacks in cryptocurrency markets and underscore the importance of international cooperation. Moving forward, the development of more integrated legal and technological solutions is anticipated in the fight against state-sponsored cybercrime.