Cryptocurrency exchange Bybit announced a civil lawsuit against North Korea, its intelligence agency, and the hacker group Lazarus Group over the theft of $1.5 billion in February 2025. The lawsuit also names twenty unidentified individuals and entities as defendants.
The FBI confirmed the involvement of North Korean hackers in the breach shortly after the attack.
Bybit filed the documents in the federal court of the District of Columbia on June 18. The exchange seeks the return of the stolen assets, compensation of approximately $1.5 billion, punitive damages, and treble damages under the U.S. RICO Act against organized crime.
The court granted Bybit’s motions in three stages:
- June 19 — expedited discovery and restrictions on transactions involving traced assets;
- July 16 — extension of these restrictions;
- July 30 — partial approval of the preliminary injunction request.
Some case materials remain sealed.
Thanks to expedited discovery, the exchange gained the right to request information from U.S. trading platforms about account holders, balances, and transactions. Bybit claims that some of the stolen funds ended up on these platforms, and some agreed to cooperate after receiving a court order.
“Our mission remains unchanged: to protect users, recover as much as possible, and hold the attackers accountable. The Lazarus attack was not only against Bybit — it undermined trust in the entire industry,” said Bybit co-founder and CEO Ben Zhou.
The company emphasized that the civil proceedings are running parallel to criminal investigations by U.S. law enforcement and are independent of them.
Less Than 10% of Funds Traced
By the time the lawsuit was filed, 90.2% of the stolen funds had become untraceable, having passed through mixers, cross-chain bridges, and over-the-counter dealers. Only 9.8% were found in identifiable wallets, of which only 5.3% of the total amount, equivalent to approximately $75.5 million, were frozen or recovered.
For comparison, a year earlier, Zhou estimated the share of traceable assets at 68.6%.
Cryptocurrency as a New Revenue Source for Pyongyang
The stolen cryptocurrencies have become an independent source of revenue for North Korea. According to Bloomberg Economics, the country received up to $22 billion from abroad between 2022 and 2025 — nearly four times more than in the previous four years. This estimate is based on trade statistics, intelligence reports, and independent research.
While military-technical supplies from Russia provided the main income for Pyongyang, Kim Jong Un also expanded other channels. According to TRM Labs, the share of North Korean hackers in global crypto thefts increased from 30% in 2017 to the current 70%.
Chinese criminal groups are involved in laundering, providing offshore accounts for a fee, said TRM Labs investigator Nick Carlsen.
“It’s absurd that North Korea has access to such funds,” he said, suggesting the U.S. implement a reward system for uncovering thefts.
The funds are used for the nuclear program. Bloomberg estimates that in ten years, North Korea’s arsenal could rival France’s. However, the accuracy of these estimates is limited — the country does not publish statistics, conceals deals, and some revenue remains abroad due to lack of access to the banking system.
Earlier in August, Greek cybersecurity expert Vangelis Stikas discovered signs of North Korean-linked hackers infiltrating systems of 1,640 organizations across 57 countries.
Previously, CertiK analysts also noted that North Korean perpetrators have turned cryptocurrency theft into a large-scale state operation with its own money-laundering infrastructure and network of IT agents.
